[Ubuntu 24.04][Sandbox] start reaches Ready then fails launch-readiness epoch revalidation

## Description

On Ubuntu 24.04, a stopped sandbox starts, reaches Ready, and completes the fast gateway, process, forward, inference, and pairing checks, but the command still exits nonzero because the current launch-readiness epoch cannot be safely revalidated. The lifecycle documentation says start returns success after the recovered runtime is authenticated, OpenShell reports the sandbox ready, and host-side forwards pass checks; if old launch-readiness evidence is unsafe, ordinary launch should either rotate/publish fresh evidence or provide a real repair path rather than fail after readiness is already proven.

Platform scope: Platform-specific: reproduced on Ubuntu 24.04 x86_64; other platforms were not confirmed for this exact start-path epoch failure.
Regression: Unknown — earlier versions were not checked for this exact start-path epoch case.
OpenShell issue: No — this is NemoClaw launch-readiness evidence and lifecycle reporting.

## Environment

```text
Device: Ubuntu 24.04 release-validation runner
OS: Ubuntu 24.04 Linux
Architecture: x86_64
Node.js: v22.22.3 from CI snapshot
npm: 10.9.8 from CI snapshot
Docker: Docker Engine 29.4.0
OpenShell CLI: openshell 0.0.106
NemoClaw: nemoclaw v0.0.116
OpenClaw: Not captured
```

## Steps to Reproduce

1. Onboard a persistent sandbox on Ubuntu 24.04.
2. Stop the sandbox.
3. Start the same sandbox again.
4. Observe the readiness and publication-probe section of the start output.

## Expected Result

After the sandbox is started, reported Ready, and all runtime and host-forward checks pass, start exits successfully. If launch-readiness evidence must be refreshed, the command rotates or publishes the new epoch as part of the successful start path.

## Actual Result

The container starts and the sandbox reports Ready within a few seconds. Gateway, process, forward, inference, and pairing checks report fast completion, but the result is failed at publication and the command exits nonzero with launch-readiness epoch revalidation guidance.

## Logs

```text
Start output excerpt:
Container started.
Restoring sandbox startup state.
Waiting for sandbox to be ready.
Status: Ready
Checking gateway health and host forwards.
Probe timing: readiness, authority, lifecycle, gateway, processes, forward, inference, pairing, and publication all completed quickly
lifecycleAction=skipped forwardAction=skipped result=failed failedStage=publication
Probe failed: complete probe and recovery did not run because the current launch-readiness epoch could not be safely revalidated.
```