LKG v0.0.109 Personal onboarding fails on overlapping policy endpoints

## Priority

High. A default LKG Hermes installation can reach sandbox creation, then fail at the final policy step when the operator selects Personal.

## Description

The served installer currently resolves `lkg` to v0.0.109. That revision composes `personal-open-internet` with exact web endpoints from Slack, Hermes, PyPI, managed inference, NVIDIA, and other presets.

OpenShell rejects the combined policy because the hostless Personal endpoint overlaps port 443 with different protocol, enforcement, `allowed_ips`, and credential-rewrite metadata. Onboarding stops at step 8 after the sandbox has already been created.

The observed error begins:

```text
network endpoint ambiguity validation failed:
network policies 'slack' endpoint[0] (slack.com:443) and
'personal_open_internet' endpoint[0] (:80,443) overlap
```

## Current implementation status

This code defect is already fixed on `main` by PR #9346 at commit `4a179614ac8a07273fce8f1cb679b33c0444f5c4`.

That change makes Personal the sole composed authority for ports 80 and 443 while preserving non-web endpoints and failing closed if the reviewed Personal entry drifts. v0.0.110 is the first release tag that contains the fix. v0.0.109 does not contain `normalizePersonalOpenInternetPolicy`.

This issue therefore owns LKG release qualification and promotion, not a duplicate implementation.

## Reproduction

1. Install the current default LKG with `NEMOCLAW_AGENT=hermes`.
2. Complete Hermes sandbox creation.
3. At policy tier selection, choose Personal while default or selected web presets such as Slack remain present.
4. Observe OpenShell reject the merged policy for endpoint ambiguity.

The reproduced installation used an alternate OpenShell gateway port because the host had an existing gateway service. That port selection is unrelated to the policy failure.

## Immediate recovery

Resume the interrupted session with the same gateway port and select Balanced instead of Personal:

```bash
NEMOCLAW_GATEWAY_PORT=8990 nemohermes onboard --resume
```

The sandbox is intact; no fresh onboarding or sandbox deletion is required.

## Expected behavior

The default LKG must not offer a Personal onboarding path that its shipped policy composer cannot apply.

## Acceptance criteria

- [ ] The promoted LKG contains PR #9346 or equivalent Personal overlap normalization.
- [ ] The promoted LKG contains the accepted fix for #10826 / PR #10831.
- [ ] A clean default-installer Hermes journey reaches onboarding 8/8 with Personal selected.
- [ ] The effective policy contains `personal_open_internet` as the sole port-80/443 network context and retains required non-web endpoints.
- [ ] OpenShell reports no endpoint ambiguity for Slack, Hermes, PyPI, managed inference, NVIDIA, or other selected presets.
- [ ] Balanced remains a valid recovery path for an interrupted v0.0.109 session.
- [ ] Exact installer, NemoClaw commit, OpenShell version, base-image digest, gateway port, and E2E evidence are recorded before LKG moves.

## Related work

- #9206 / PR #9346 — implemented Personal overlap normalization; first shipped in v0.0.110
- #10826 / PR #10831 — Hermes LKG tracked base-image fallback blocker
- #10824 — separate default gateway-port conflict from the same installation