Exit cleanup reports "status null" / exit 1 when docker group membership came via `sg docker` instead of a fresh login

```
Host: Windows 11 + WSL2 Ubuntu (kernel 5.15.167.4-microsoft-standard-WSL2), Docker Desktop (WSL2 backend)
NemoClaw v0.0.109 (OpenShell runtime 0.0.101) · OpenClaw 2026.7.1 (2d2ddc4) · mcporter 0.7.3 (in sandbox)
Sandbox: `retrace-pilot`, Debian GNU/Linux 13 (trixie) · Provider: ollama-local → http://host.openshell.internal:11434/v1, preferredInferenceApi openai-completions · Ollama 0.33.2 (Windows host)
Models: qwen3.5:4b (2a654d98e6fb, 3.4GB), qwen3:8b (500a1f067a9f, 5.2GB)
MCP server under test: stateless Streamable HTTP endpoint (JSON or SSE responses; GET/DELETE → 405), bearer auth
```

_Found while wiring an MCP audit server ([Retrace](https://github.com/jordandru/retrace)) into an OpenClaw agent running in a NemoClaw sandbox; the full debugging trail is in a public provenance ledger: https://retrace-api.slcwitit.workers.dev/s/sh_ea81439e010abb1c0ec7167c (events evt_20c50c96, evt_4b22e5aa, evt_f14b52db)._

**What happens**
In a shell that predates the user's docker group membership (so docker works only via `sg docker -c …`), the NemoClaw TUI runs fine, but its exit cleanup cannot discover the container. Verbatim (after Ctrl+C out of `sg docker -c "nemoclaw launch retrace-pilot"`):
"OpenClaw permission cleanup failed (command exit 0; cleanup exit 1): Direct sandbox container discovery failed for 'retrace-pilot': Command failed with status null (before repair: could not stat config (Direct sandbox container discovery failed for 'retrace-pilot': Command failed with status null))"
Likely cause: the cleanup subprocess does not inherit the `sg docker` socket access the launch had.

**Repro**
1. Add user to the docker group; do NOT re-login; use `sg docker -c nemoclaw …` from the old shell.
2. Use the TUI normally; exit.
3. Cleanup error as above; the container needs manual handling.

**Expected**
Cleanup should either use the same docker access path the launch used, or say clearly that the group membership isn't visible to this shell (fresh-login hint). This is a WSL2-common situation — the group change lands mid-session.

Start at the NemoClaw launch and exit-cleanup paths, especially direct sandbox container discovery, and reproduce the failure with `sg docker -c "nemoclaw launch retrace-pilot"`. Compare docker access available to launch and cleanup, then verify that cleanup succeeds or reports a clear fresh-login or group-membership hint, with a regression test for the old-shell case.

Written by the indexing model from the issue text.