[All Platforms][Docs] Change the Baseline Network Policy pages describe the policy entry fields incorrectly, so following them makes onboarding fail

## Description

The Change the Baseline Network Policy pages tell the reader to add endpoint entries to `nemoclaw-blueprint/policies/openclaw-sandbox.yaml` and describe each entry as having the fields `endpoints`, `binaries`, `rules` and `allow_encoded_slash`. That description is wrong in three ways, and an entry written to match it is rejected.

1. A required `name` field is not mentioned at all. Every entry in the shipped file carries one, matching its key.
2. `rules` is presented as a sibling of `endpoints` and `binaries`. In the shipped schema `rules` lives inside each endpoint, not at the top level of the entry.
3. `binaries` is described as "Executables allowed to use the endpoint", which reads as a list of paths. The schema expects a list of mappings of the form `{ path: /usr/bin/curl }`. A bare string is rejected outright.

Each of the three was isolated independently against a known-good entry, changing one thing at a time, and each on its own is sufficient to fail onboarding.

The page carries no YAML example at all, and the linked Network Policies reference page does not document a `name` field either, so a reader has no second source that would correct the omission.

The rest of the procedure is accurate: the file is at the documented path, the source-checkout and OpenShell-on-PATH prerequisites hold, and re-running onboarding does apply the edited baseline to the new sandbox.

Both language variants carry the same field list:
- `docs.nvidia.com/nemoclaw/user-guide/openclaw/network-policy/configure-policies/change-baseline-network-policy`
- `docs.nvidia.com/nemoclaw/user-guide/hermes/network-policy/configure-policies/change-baseline-network-policy`

Platform scope: The schema is platform-independent; verified on Ubuntu 24.04 x86_64.
Regression: Unknown - earlier documentation revisions not compared.

## Environment

```text
Device: Ubuntu 24.04 virtual machine, no GPU
OS: Ubuntu 24.04 LTS
Architecture: x86_64
Node.js: v22.23.2
npm: 10.9.8
Docker: 29.6.1
OpenShell CLI: 0.0.106
NemoClaw: v0.0.118
OpenClaw: 2026.7.1
```

## Steps to Reproduce

```bash
# 1. Open either published page and note the four fields it lists for an entry.

# 2. Control first: with the file untouched, onboard and record the exit code.
nemoclaw onboard --name ctrl --agent openclaw --non-interactive --fresh --yes --no-gpu

# 3. Add an entry written exactly to the page's field list, under network_policies
# in nemoclaw-blueprint/policies/openclaw-sandbox.yaml, then re-run onboarding:
#
# qa_doc_check:
# endpoints:
# - host: example.com
# port: 443
# binaries:
# - /usr/bin/curl
# rules:
# - methods: [GET]
# paths: ["/"]
# allow_encoded_slash: false

# 4. Replace it with an entry written to the shipped schema, copied from the
# existing managed_inference entry in the same file, and onboard again:
#
# qa_doc_check:
# name: qa_doc_check
# endpoints:
# - host: example.com
# port: 443
# protocol: rest
# enforcement: enforce
# rules:
# - allow: { method: GET, path: "/**" }
# binaries:
# - { path: /usr/bin/curl }

# 5. Confirm whether the entry reached the sandbox:
nemoclaw SANDBOX policy get | grep qa_doc_check
```

## Expected Result

An entry written to the fields the page lists is accepted, onboarding exits 0, and the entry appears in the sandbox's live policy.

## Actual Result

```text
Control, file untouched:
onboard exit 0

Entry written to the page's field list, no name field:
onboard exit 1
Error: applyPresets(npm,pypi,huggingface,brew,openclaw-pricing) returned false

Same entry with name added but binaries still a list of strings:
onboard exit 1
Error: failed to parse sandbox policy YAML
network_policies.qa_doc_check.binaries.[0]: invalid type: string
"/usr/bin/curl", expected struct NetworkBinaryDef at line 82 column 9

Entry written to the shipped schema:
onboard exit 0
nemoclaw SANDBOX status exit 0
policy get | grep qa_doc_check 2 matches

Per-claim isolation, one variable at a time against the known-good entry:

correct schema (control) onboard exit 0
same, with the name field removed onboard exit 1
same, with rules moved to the entry level onboard exit 1
same, with binaries as bare strings onboard exit 1

So all three deviations the page's field list would lead a reader into are
independently sufficient to fail onboarding.

Secondary observation on diagnostic quality: only the binaries case names the
offending field. Removing name fails with "applyPresets(...) returned false",
which does not mention the policy entry, the missing field, or the file that
was edited.
```

## Logs

```text
The shipped entry the correct form was copied from, for reference:

managed_inference:
name: managed_inference
endpoints:
- host: inference.local
port: 443
protocol: rest
enforcement: enforce
rules:
- allow: { method: GET, path: "/**" }
- allow: { method: POST, path: "/**" }
binaries:
- { path: /usr/local/bin/openclaw }
- { path: /usr/bin/curl }
```

Open the two published Change the Baseline Network Policy pages and compare their field descriptions with nemoclaw-blueprint/policies/openclaw-sandbox.yaml, especially the managed_inference entry. Update both language variants to match the shipped schema, then rerun the documented onboarding commands and verify the edited entry appears with nemoclaw SANDBOX policy get.

Written by the indexing model from the issue text.