credentials add: apply egress policy derived from a custom provider profile's endpoints

### Problem Statement

A custom provider profile (imported with `openshell provider profile import`) can declare `endpoints` and `binaries`, and `nemoclaw credentials add --type ` registers the credential and exports the placeholder into sandboxes built afterwards. But the profile's endpoints do not become sandbox egress policy: a request to the declared host is refused at the proxy (`Tunnel connection failed: 403 Forbidden`) until the operator also writes and applies a separate custom preset for the same endpoint.

For the maintained presets (Tavily, Brave) NemoClaw does both halves itself; for a custom profile the two halves are easy to get wrong and drift apart.

### Desired Behavior

When a credential is registered from a profile that declares endpoints, NemoClaw offers (or performs with `--apply-policy`) a preset derived from those endpoints, deny rules, and binaries, and reapplies it on rebuild. `credentials list` shows whether the policy is applied.

### Scope and Exclusions

Profiles with endpoints only; endpointless profiles (`nemoclaw-mcp-v1`) unchanged.

### Ongoing Ownership

Maintainers of credentials/policy presets.

### Placement and Support Expectations

Core NemoClaw.

### Validation Plan

Register a custom profile with one endpoint and a deny rule; after onboarding, a sandbox request to the endpoint is allowed with the injected credential and the denied tool is blocked, without a separate `policy add`.

### Compatibility Requirements

Opt-in; existing `credentials add` behavior unchanged without the flag.

### Security or Privacy Impact

None beyond the endpoints the operator already declared and reviewed in the profile.

### Implementation Idea

Render a preset from the profile at `credentials add` time (same shape as `create-custom-policy-presets`), namespace it by provider, and add it to the rebuild reconciliation.

### Checklist

- [x] I searched existing issues and this is not a duplicate
- [x] I described the problem and desired behavior

Start by tracing the `nemoclaw credentials add`, `credentials list`, and `policy add` entry points, along with `create-custom-policy-presets` and rebuild reconciliation. Reproduce the validation plan with a custom profile containing one endpoint and a deny rule; done means the opt-in flow allows the endpoint, blocks the denied tool, and preserves existing behavior without the flag.

Written by the indexing model from the issue text.