[DGX Spark][Agent&Skills] Agent Browser is unusable in a NemoHermes sandbox on Linux ARM64: no bundled Chromium and its installer refuses ARM64

## Description

Inside a NemoHermes sandbox on Linux ARM64, the Agent Browser tool cannot run. The image ships
the agent-browser runtime but no browser: the pre-baked runtime directory contains only Node
modules, and no Chromium-family binary is present anywhere in the sandbox. When the agent uses
the browser tool, the browser harness fails with a fatal "no supported Chromium-family browser
is running" error.

The documented way to provide that browser does not work on this architecture. Running the
runtime's own installer reports that Chrome for Testing publishes no Linux ARM64 build and
directs the user to install Chromium from the host package manager, which a sandbox with a
narrowed egress policy cannot reach.

The same image on x86_64 installs a browser successfully, so the sandbox browser tool is usable
there and unusable on ARM64.

Platform scope: Platform-specific: fails on Linux ARM64 (DGX Spark); verified working on Linux
x86_64, where the runtime installer downloads Chrome for Testing successfully.
Regression: Unknown - earlier releases were not tested for this path.
OpenShell issue: No. The gap is in the NemoHermes sandbox image contents.

## Environment

```text
Device: NVIDIA DGX Spark (failing) and a generic x86_64 host (working control)
OS: Ubuntu 24.04.4 LTS (aarch64); Ubuntu 22.04.5 LTS (x86_64 control)
Architecture: aarch64 (failing), x86_64 (working)
Kernel: 6.17.0-1014-nvidia
Node.js: v22.23.1
npm: 10.9.8
Docker: Docker version 29.2.1 (aarch64); Docker version 29.6.1 (x86_64)
OpenShell CLI: openshell 0.0.106
NemoClaw: nemoclaw v0.0.120
Agent Browser: agent-browser 0.26.0 (same version on both architectures)
```

## Steps to Reproduce

```bash
1. Onboard a NemoHermes sandbox on a Linux ARM64 host.

2. Enable the managed browser gateway policy preset and remove the runtime package-registry
presets so the sandbox matches a browser-allowed, registry-denied policy:

nemoclaw {sandbox} policy add nous-browser --yes
nemoclaw {sandbox} policy remove npm
nemoclaw {sandbox} policy remove brew
nemoclaw {sandbox} policy remove huggingface

3. Ask the agent to use the browser tool to navigate to a public page and report the page title.

4. Inside the sandbox, inspect what the image actually provides:

ls /opt/nemoclaw-agent-browser-runtime/
command -v chromium chromium-browser google-chrome
agent-browser --version

5. Inside the sandbox, run the runtime's own browser installer:

agent-browser install

6. Repeat steps 4 and 5 in a NemoHermes sandbox on an x86_64 host and compare.
```

## Expected Result

The browser session opens the requested page and the agent reports the real page title, without
a package-installation or missing-runtime error, because the offline Agent Browser runtime is
usable without reaching a runtime package registry.

## Actual Result

On ARM64 the agent cannot browse. The harness reports:

fatal: chrome-not-running: no supported Chromium-family browser is running -- start Chrome,
then retry

The image provides no browser to start. The pre-baked runtime directory holds only Node modules:

node_modules
package-lock.json
package.json

and no Chromium-family binary is on PATH or on disk in the sandbox.

The runtime's own installer refuses to supply one on this architecture:

Chrome for Testing does not provide Linux ARM64 builds.
Install Chromium from your system package manager instead:
sudo apt install chromium-browser # Debian/Ubuntu
sudo dnf install chromium # Fedora
Then use: agent-browser --executable-path /usr/bin/chromium

That fallback requires the package manager, which the policy under test denies.

x86_64 control, same image family and same agent-browser 0.26.0, succeeds:

Installing Chrome...
Downloading Chrome 152.0.7977.82 for linux64
Chrome 152.0.7977.82 installed successfully

## Logs

```text
Browser harness log inside the failing sandbox:

fatal: chrome-not-running: no supported Chromium-family browser is running -- start Chrome,
then retry

Agent reply when asked to navigate with the browser tool:

BROWSER_UNAVAILABLE browser-harness: daemon default did not come up
```

Start by locating the NemoHermes sandbox image definition and the packaging for /opt/nemoclaw-agent-browser-runtime; compare the ARM64 and x86_64 build paths. Reproduce with agent-browser install under the browser-allowed, registry-denied policy, then verify that the browser tool opens a page and reports its title.

Written by the indexing model from the issue text.