[Ubuntu 22.04][Onboard] Local Ollama upgrade stops after service-user execution proof timeout

## Description

When an Ubuntu host starts with an older system Ollama installation and the user selects the local Ollama install or upgrade path, NemoClaw downloads the required Ollama release but stops before onboarding because the service-user execution proof times out. The sandbox is not created even though the host can be restored to a healthy Ollama service afterward.

Platform scope: Reproduced on Ubuntu 22.04 only; other platforms not tested.
Regression: Unknown.
OpenShell issue: No.

## Environment

```text
Device: Ubuntu 22.04 test host
OS: Ubuntu 22.04.5 LTS
Architecture: x86_64
Node.js: v22.22.0
npm: 10.9.4
Docker: Docker version 29.6.1
OpenShell CLI: openshell 0.0.106
NemoClaw: current public installer build used by the test host
OpenClaw: N/A, onboarding did not complete
```

## Steps to Reproduce

1. On a native Ubuntu 22.04 host with Docker, passwordless sudo, and zstd installed, install and start an older Ollama release through the official Ollama installer.
2. Confirm that `ollama --version` and the loopback `/api/version` endpoint both report the older version.
3. Run NemoClaw onboarding with local Ollama installation selected:

```bash
NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1 NEMOCLAW_NON_INTERACTIVE=1 NEMOCLAW_PROVIDER=install-ollama NEMOCLAW_MODEL=qwen2.5:1.5b NEMOCLAW_SANDBOX_NAME=ollama-upgrade NEMOCLAW_POLICY_MODE=skip NEMOCLAW_SANDBOX_READY_TIMEOUT=1500 nemoclaw onboard --fresh --no-gpu
```

4. Observe the Ollama upgrade section of onboarding.

## Expected Result

NemoClaw should upgrade the older host Ollama to the required release, restart the Ollama service successfully, continue onboarding, and create a ready sandbox using the local Ollama provider.

## Actual Result

NemoClaw requests and downloads the required Ollama release, then stops during the service-user execution proof:

```text
Requesting Ollama 0.32.9 from the installer.
Creating ollama systemd service...
Enabling and starting ollama service...
Verifying the configured Ollama systemd user can execute its binary and ELF interpreter...
Ollama service execution proof failed [execution-timeout]: Ollama ExecStart did not complete '--version' as systemd User 'ollama' within 15 seconds.
NemoClaw did not restart the Ollama service.

Onboarding did not finish.
```

## Logs

```text
[1/8] Preflight checks
Docker daemon: server 29.6.1
Docker can start bridge containers
Docker container DNS resolution works
Container runtime: docker
Sandbox GPU: disabled by configuration

[3/8] Configuring inference provider
[non-interactive] Provider: install-ollama
The Ollama installer creates a system user, a systemd service, and writes to /usr/local. It uses sudo, may ask for your password, and can take a few minutes; installer output will stream below.
Requesting Ollama 0.32.9 from the installer.
Cleaning up old version at /usr/local/lib/ollama
Installing ollama to /usr/local
Downloading ollama-linux-amd64.tar.zst
Adding ollama user to render group...
Adding ollama user to video group...
Adding current user to ollama group...
Creating ollama systemd service...
Enabling and starting ollama service...
NVIDIA GPU installed.
Verifying the configured Ollama systemd user can execute its binary and ELF interpreter...
Ollama service execution proof failed [execution-timeout]: Ollama ExecStart did not complete '--version' as systemd User 'ollama' within 15 seconds.
NemoClaw did not restart the Ollama service.
```

Start by reproducing the documented `nemoclaw onboard --fresh --no-gpu` command on Ubuntu 22.04 and trace the `install-ollama` onboarding path through the service-user execution proof. Inspect the Ollama service startup and `--version` timeout behavior around the 15-second limit. Done means the older Ollama release upgrades successfully, the service restarts, onboarding continues, and the sandbox is created.

Written by the indexing model from the issue text.