Add Windows MXC policy and managed-inference integration

Part of #8178.

This task completes policy and credential behavior for the accepted native Windows preview candidate. It does not activate MXC.

## Outcome

OpenClaw inside the Windows MXC sandbox receives the accepted filesystem and governed-egress policy and can use managed inference without receiving the upstream provider credential.

## Delivery state

Dormant policy and managed-inference integration.

## Dependencies

- Blocked by #10585 and acceptance of the preview policy and inference scope.
- May proceed in parallel with #10586 and the lifecycle slice.
- Contributes to the protected E2E and activation gate.

## Deliverables

- Map accepted Windows filesystem roots and shallow OpenShell-controlled state paths without broad parent access.
- Apply governed egress and prove direct egress remains denied.
- Route the accepted inference API through OpenShell-managed credential custody or another explicitly accepted provider boundary.
- Keep credentials out of the sandbox, receipts, process arguments, logs, and evidence artifacts.
- Report unsupported local inference or GPU behavior through typed capability results.

## Acceptance evidence

- Allowed: declared filesystem and network access succeeds and one real accepted inference request completes.
- Denied: undeclared filesystem access, direct egress, credential reads, credential logging, and unsupported inference capabilities fail closed.
- Ambiguous: missing effective-policy acknowledgement or inference route identity blocks onboarding rather than applying a broader default.
- Failure or recovery: inference or proxy failure preserves credential custody and leaves no temporary secret material.

## Security and authority boundaries

- OpenShell owns effective network enforcement and credential replacement.
- NemoClaw owns the requested policy, provider binding, redaction, and acceptance evidence.
- Credential location, access, lifetime, transfer boundary, rotation, and removal must be documented and tested.

## Test plan

- Deterministic policy mapping, effective-policy acknowledgement, SSRF, redaction, and credential-boundary tests.
- Physical allowed and denied filesystem and network probes.
- One accepted managed-inference agent request with negative credential-disclosure evidence.

## Deferred scope

- GPU passthrough, unaccepted inference providers, Hermes, and production activation.

## Stop conditions

- Stop if OpenShell cannot report the effective policy required for acceptance.
- Stop if a provider credential must enter the sandbox or if policy must be broadened to make the workload run.

## Completion evidence

- Link the implementation PR, exact merged commit, policy receipts, inference identity, and sanitized physical evidence. One same-repository PR should close this issue.