[DGX Spark][Inference] Local Ollama route update can fail pairing and return no agent response

> [!WARNING]
> **Regression** — the provider-switch path was previously fixed under #9527; it reproduces in v0.0.118.

## Description

On a Ready OpenClaw sandbox configured for Local Ollama, `nemoclaw inference set` can commit the inference route and configuration but still exit non-zero because gateway pairing does not converge. After recovery, an OpenClaw agent command can either use embedded fallback or exit 0 without returning an agent response.

Platform scope: Reproduced on DGX Spark only; other platforms not tested

Regression: Yes — the provider-switch path was previously fixed under #9527; it reproduces in v0.0.118

OpenShell issue: No

## Environment

```text
Device: DGX Spark
OS: Ubuntu 24.04
Architecture: aarch64
Node.js: v22.23.1
npm: 10.9.8
Docker: Docker 29.2.1, build a5c7197
OpenShell CLI: 0.0.106
NemoClaw: v0.0.118
OpenClaw: 2026.7.1 (2d2ddc4)
```

## Steps to Reproduce

1. Onboard a sandbox with OpenClaw and confirm that it reaches Ready state.
2. Configure the sandbox for Local Ollama:

```bash
nemoclaw inference set --provider ollama-local --model qwen3.5:9b --sandbox {sandbox}
```

3. Observe the command result. If pairing does not converge, run:

```bash
nemoclaw {sandbox} doctor --fix
```

4. Retry the same inference set command.
5. Connect to the sandbox:

```bash
nemoclaw {sandbox} connect
```

6. Run an agent turn:

```bash
openclaw agent --agent main -m "say ok" --session-id local-ollama-check
```

## Expected Result

The inference route update completes with exit code 0. The next OpenClaw agent turn uses the managed gateway, returns an actual model response, and exits 0 without pairing errors or embedded fallback.

## Actual Result

The route and config are committed, but the first inference set command exits 1:

```text
Inference route and config were updated for '{sandbox}', but OpenClaw gateway pairing did not converge (initial-state-unavailable). The committed route was not rolled back. Run 'nemoclaw {sandbox} doctor --fix', then retry the agent turn.
```

In one run, the subsequent agent turn reported:

```text
gateway connect failed: GatewayClientRequestError: scope upgrade pending approval
EMBEDDED FALLBACK: Gateway agent failed; running embedded agent: GatewayTransportError: gateway closed (1008): pairing required: device is asking for more scopes than currently approved
```

In a clean rerun, the same agent command exited 0 after printing configuration warnings and the registration banner, but it did not return the requested `ok` response.

## Logs

```text
Doctor reported:

1 pending allowlisted tool-scope upgrade(s) blocking OpenClaw tool calls (scope upgrade pending approval); the in-sandbox auto-pair watcher is not running
```

Reproduce the flow with `nemoclaw inference set`, `doctor --fix`, `connect`, and the `openclaw agent` command on DGX Spark. Start by tracing the inference-set result and the gateway pairing or scope-upgrade messages in the reported logs. Done means the route update exits 0, pairing converges, and the next agent turn returns the requested model response without embedded fallback.

Written by the indexing model from the issue text.