feat(inference): send NemoClaw app-attribution header to NVIDIA Endpoints

### Problem Statement

NVIDIA Endpoints requests originating from NemoClaw do not currently carry an explicit application-attribution signal. As a result, `integrate.api.nvidia.com` cannot reliably distinguish NemoClaw traffic from other clients using the same NVIDIA API surface.

NemoClaw already adds product attribution for OpenRouter, but there is no equivalent attribution contract for NVIDIA Endpoints.

### Desired Behavior

Every API request that NemoClaw sends to NVIDIA Endpoints should include this fixed header:

```http
X-BILLING-INVOKE-ORIGIN: NemoClaw
```

This should cover all NemoClaw-owned paths whose final upstream is `integrate.api.nvidia.com`, including:

- model catalog requests such as `GET /v1/models`;
- onboarding and inference-validation requests;
- managed runtime inference routed through `https://inference.local` and OpenShell's `nvidia` provider; and
- the optional NVIDIA model-router path, when enabled.

Requests to other providers or user-supplied compatible endpoints must not receive this header.

### Proposal Details

### Scope and Exclusions

In scope:

- Add the exact fixed header and value above to NemoClaw-originated NVIDIA Endpoint requests.
- Preserve the header through the managed OpenShell inference route to the final NVIDIA upstream.
- Cover direct host-side probes and any supported router path that calls `integrate.api.nvidia.com`.

Out of scope:

- User-level tracking, identifiers, session IDs, or request-content telemetry.
- Billing, quota, or metering logic inside NemoClaw.
- Attribution for providers other than NVIDIA Endpoints.
- A general-purpose arbitrary-header configuration surface.

Current constraint: OpenShell's `nvidia` inference profile currently has no default headers and forwards only its provider allowlist. A sandbox-supplied `X-BILLING-INVOKE-ORIGIN` header would therefore be stripped on the managed `inference.local` path unless the OpenShell-owned routing contract is updated or NemoClaw uses another trusted injection point.

### Ongoing Ownership

Proposed owner: NemoClaw inference/provider maintainers, with OpenShell maintainer coordination for the managed inference-routing boundary. Final accountable ownership should be assigned during triage.

### Placement and Support Expectations

Request placement in core NemoClaw because NVIDIA Endpoints are a built-in, supported inference provider and attribution needs to apply consistently across supported agent runtimes. This is not a Community Solutions integration.

After merge, the header should be treated as part of the supported NVIDIA Endpoints request contract and kept working as NemoClaw and OpenShell routing implementations evolve.

### Validation Plan

- Unit-test direct NVIDIA model-catalog and validation request construction, asserting the exact header and value.
- Add negative tests proving the header is absent for OpenRouter, other providers, and user-supplied compatible endpoints.
- Add a managed-inference contract test with a mock NVIDIA upstream proving a request through `inference.local` reaches the upstream with the header exactly once.
- Validate the supported OpenShell version's NVIDIA profile or trusted adapter injection point.
- Test the optional model-router path if it remains a supported route to `integrate.api.nvidia.com`.
- Verify the header contains no credentials or user/session identifiers and cannot be redirected to an unapproved host.

### Compatibility Requirements

Expected across all supported NemoClaw agents, operating systems, and hardware when the selected provider is NVIDIA Endpoints. The behavior should not depend on OpenClaw, Hermes, or Deep Agents Code request-generation details.

The implementation must account for NemoClaw's supported OpenShell version and its per-provider header filtering. Custom NVIDIA-compatible endpoints are excluded unless they use the canonical `integrate.api.nvidia.com` origin.

### Security or Privacy Impact

The fixed value `NemoClaw` discloses product identity to NVIDIA Endpoints but contains no user identity, credential, session identifier, prompt content, or device information. The header must be scoped to the canonical NVIDIA Endpoint origin so it cannot leak to unrelated providers or user-controlled URLs.

### Implementation Idea

Use one shared constant for the header name and value. Apply it to NemoClaw's direct NVIDIA HTTP probes and router configuration. For managed runtime traffic, coordinate with OpenShell so the `nvidia` provider injects the fixed header as a trusted default header; merely adding it inside the sandbox is insufficient because the current `inference.local` route strips non-allowlisted caller headers.

### Category

Provider

### Checklist

- [x] I searched existing issues and this is not a duplicate
- [x] I described the problem and desired behavior

Start by locating NemoClaw's direct NVIDIA model-catalog and validation request construction, then trace the managed `inference.local` route through OpenShell's `nvidia` provider and the optional model-router path. Use the validation plan as the test map: assert the exact header on NVIDIA requests, absence for other providers and custom endpoints, and single preservation to a mock upstream; confirm the supported OpenShell injection and filtering contract.

Written by the indexing model from the issue text.