rebuild: Hermes replacement journaling requires a nonexistent onboarding session

## Investigation Summary

- Both [normal Hermes rebuild](https://github.com/NVIDIA/NemoClaw/actions/runs/33730208977/job/100568886860) and [stale-base rebuild](https://github.com/NVIDIA/NemoClaw/actions/runs/33730208977/job/100568886562) fail on `3076188279c0ea657ec77aeeabebf1f82061eaaf`.
- Both repeat on `eb3fa2e5097389d7dd8e2643552788ff16d8f14a`: [normal rebuild](https://github.com/NVIDIA/NemoClaw/actions/runs/33761515943/job/100678908598) and [stale-base rebuild](https://github.com/NVIDIA/NemoClaw/actions/runs/33761515943/job/100678908471).
- Direct `nemoclaw rebuild` has no onboarding session, but the replacement transaction now requires one to journal the sandbox.
- The contract was introduced in [PR #10491](https://github.com/NVIDIA/NemoClaw/pull/10491).

## Description

The supported direct rebuild command reaches replacement journaling and aborts because it is not owned by an onboarding session.

Expected: rebuild journaling supports a rebuild-owned transaction or creates the required durable session explicitly.

Actual: both normal and stale-base rebuild paths fail before state restoration.

## Reproduction Steps

1. Onboard a Hermes sandbox.
2. Run `nemoclaw rebuild --yes`, using either the normal or stale-base fixture.
3. Observe the journal ownership failure.

## Environment

- GitHub Actions Docker E2E
- Runs: [33730208977](https://github.com/NVIDIA/NemoClaw/actions/runs/33730208977), [33761515943](https://github.com/NVIDIA/NemoClaw/actions/runs/33761515943)

## Debug Output

```text
Cannot journal sandbox '': no onboarding session exists.
```

## Acceptance Criteria

- Direct rebuild owns a durable replacement journal without depending on an onboarding session.
- Resume/rollback behavior remains safe after interruption.
- Both affected rebuild targets pass on the same candidate.

## Latest Evidence

- Both affected targets passed on exact candidate 0ddc3ea52 in [run 33915961523](https://github.com/NVIDIA/NemoClaw/actions/runs/33915961523): [normal Hermes rebuild](https://github.com/NVIDIA/NemoClaw/actions/runs/33915961523/job/101163750714) and [stale-base Hermes rebuild](https://github.com/NVIDIA/NemoClaw/actions/runs/33915961523/job/101163751215).
- No linked PR explicitly owns the journaling fix, so this issue remains open until the pass is reconciled with current main history and confirmed in a current main run.