e2e(sandbox): credential-boundary scan exceeds the fixed 60-second timeout

## Investigation Summary

- [Sandbox operations](https://github.com/NVIDIA/NemoClaw/actions/runs/33730208977/job/100568886997) passes onboard, rebuild, and provider attachment before its credential scan is terminated.
- The same exact timeout repeats on [later main](https://github.com/NVIDIA/NemoClaw/actions/runs/33761515943/job/100678908179).
- The probe scans sandbox configuration, NemoClaw state, temporary files, and processes, then receives SIGTERM at approximately 60,008 ms.
- Result is `exitCode: null`, `signal: SIGTERM`, `timedOut: true`, while the assertion requires exit 0.
- Commit [3472b0514](https://github.com/NVIDIA/NemoClaw/commit/3472b05140d51cb290f28b8115cfa0a776693439) contains an unmerged 180-second adjustment.

## Description

A bounded security scan consistently needs longer than the test harness's fixed one-minute command timeout.

Expected: the probe has a justified budget and completes, while still failing closed on leaked credentials.

Actual: the harness kills it and converts a capacity problem into an opaque assertion failure.

## Reproduction Steps

1. Run the Sandbox operations E2E.
2. Reach the credential-boundary probe after provider attachment.
3. Observe SIGTERM at the 60-second command deadline.

## Environment

- GitHub Actions Docker E2E
- Runs: [33730208977](https://github.com/NVIDIA/NemoClaw/actions/runs/33730208977), [33761515943](https://github.com/NVIDIA/NemoClaw/actions/runs/33761515943)

## Acceptance Criteria

- Give the probe an explicit measured timeout budget or make the scan bounded/faster.
- Report which scan phase/path consumed the deadline.
- Keep leak detection fail-closed.
- Sandbox operations passes on repeated main runs.

## Candidate Fix

- [PR #10695 — refactor(forward): adopt OpenShell service forwarding](https://github.com/NVIDIA/NemoClaw/pull/10695), authored by @ericksoa, merged on 2026-09-03.
- The merged change retains commit [3472b0514 — allow credential boundary scan to finish](https://github.com/NVIDIA/NemoClaw/commit/3472b05140d51cb290f28b8115cfa0a776693439), which raises the bounded scan budget from 60 seconds to 180 seconds.
- [Sandbox operations passed](https://github.com/NVIDIA/NemoClaw/actions/runs/33915961523/job/101163752295) on exact candidate 0ddc3ea52 in run 33915961523.
- Keep this issue open until a current main run confirms the target again and supplies the repeated evidence required by the acceptance criteria.