[Security] Sandbox startup script accepts invalid values (0, negative, Infinity) for reentry timing settings without rejecting them

## Description

The managed sandbox images' OCI entrypoint (`entrypoint-env-wrapper.sh` / `nemoclaw-start`) validates most of the env vars it accepts before invoking the wrapped command — missing terminator, too many assignments, unsupported variable names, and duplicate assignments are all correctly rejected. Two numeric-bounds checks are missing at this layer: `NEMOCLAW_AUTO_PAIR_FAST_REENTRY_INTERVAL_SECS` and `NEMOCLAW_AUTO_PAIR_FAST_REENTRY_POLLS` are only range-validated in NemoClaw's own CLI code when it constructs the `docker run` command — never inside the entrypoint script itself. Since the managed sandbox image is an ordinary OCI image pullable from the registry, anyone who can run `docker run --entrypoint ...` against it directly bypasses the CLI's validation entirely and can pass unbounded/invalid values straight into the container's process environment.

Platform scope: Reproduced on Ubuntu 24.04 x86_64; container/script logic is host-OS-agnostic.
Regression: Unknown — earlier versions not tested.

## Environment

```text
Device: x86_64 server
OS: Ubuntu 24.04.4 LTS
Architecture: x86_64
Docker: Present (container runtime)
NemoClaw: v0.0.120
```

## Steps to Reproduce

1. Pull the OpenClaw managed sandbox image (any recent build).
2. Run directly, bypassing the NemoClaw CLI:
```bash
docker run --rm env NEMOCLAW_AUTO_PAIR_FAST_REENTRY_INTERVAL_SECS=0 NEMOCLAW_AUTO_PAIR_FAST_REENTRY_POLLS=3 nemoclaw-start /bin/sh -c 'printf "INTERVAL_SEEN=[%s]\nPOLLS_SEEN=[%s]\n" "$NEMOCLAW_AUTO_PAIR_FAST_REENTRY_INTERVAL_SECS" "$NEMOCLAW_AUTO_PAIR_FAST_REENTRY_POLLS"'
```
3. Repeat with `NEMOCLAW_AUTO_PAIR_FAST_REENTRY_INTERVAL_SECS=-1`.
4. Repeat with `NEMOCLAW_AUTO_PAIR_FAST_REENTRY_POLLS=Infinity`.
5. Repeat with `NEMOCLAW_AUTO_PAIR_FAST_REENTRY_POLLS=9007199254740993` (exceeds `Number.MAX_SAFE_INTEGER`).

## Expected Result

Each invocation exits non-zero. `NEMOCLAW_AUTO_PAIR_FAST_REENTRY_INTERVAL_SECS=0/-1` is rejected with an error mentioning a finite positive seconds requirement; `NEMOCLAW_AUTO_PAIR_FAST_REENTRY_POLLS=Infinity/9007199254740993` is rejected with an error mentioning a positive safe integer requirement — the same numeric bounds the CLI already enforces should also be enforced by the entrypoint script itself, matching the enforcement already in place for the other malformed-input checks at this layer (missing terminator, unsupported variable names, duplicate assignments).

## Actual Result

All four invocations exit 0. The container starts normally and the invalid values are preserved unmodified in the process environment (confirmed via direct process-environment inspection):

```text
INTERVAL_SEEN=[0]
INTERVAL_SEEN=[-1]
POLLS_SEEN=[Infinity]
POLLS_SEEN=[9007199254740993]
```

No fallback substitution and no rejection occurs at the entrypoint layer.

## Logs

```text
$ docker run --rm env NEMOCLAW_AUTO_PAIR_FAST_REENTRY_INTERVAL_SECS=0 NEMOCLAW_AUTO_PAIR_FAST_REENTRY_POLLS=3 nemoclaw-start /bin/sh -c 'printf "INTERVAL_SEEN=[%s]\nPOLLS_SEEN=[%s]\n" "$NEMOCLAW_AUTO_PAIR_FAST_REENTRY_INTERVAL_SECS" "$NEMOCLAW_AUTO_PAIR_FAST_REENTRY_POLLS"'
Setting up NemoClaw...
[gateway] NEMOCLAW_ENTRYPOINT_MODE=root
[config] Baseline snapshot created...
INTERVAL_SEEN=[0]
POLLS_SEEN=[3]
exit code: 0
```