[Ubuntu 22.04][Upgrade] a Shields-era sandbox cannot be migrated after upgrade: rebuild and recreate both refuse with the same retired-Shields message

## Description

A sandbox that was created on the previous release and had Shields enabled cannot be migrated after upgrading to the release that retires Shields. The upgrade prints guidance naming two recovery paths, and both of them refuse with that same message, so the sandbox is left with a legacy state record and no supported way forward.

The product's own text is the loop: it says to "back up trusted user data and rebuild or recreate affected sandboxes with the current version", but `rebuild` and `onboard --recreate-sandbox` each stop with the identical Shields-retired message and change nothing. The only command that succeeds is `destroy`, which discards the sandbox instead of migrating it.

The sandbox stays Ready and usable throughout, so nothing forces the user to act until they try to rebuild for any reason and discover the sandbox can never be rebuilt again.

- **Platform scope:** Reproduced on Ubuntu 22.04 x86_64; other platforms not tested for this path, but the migration boundary is version state handling rather than host specific.
- **Regression:** Not applicable — the retirement itself is new in this release; the gap is that its migration path does not work.
- **OpenShell issue:** No. The refusal comes from NemoClaw's own upgrade boundary.

## Environment

```text
Device: Generic x86_64 virtual machine
OS: Ubuntu 22.04.5 LTS
Architecture: x86_64
Node.js: v22.23.1
Docker: Docker version 29.6.1
OpenShell CLI: openshell 0.0.106
NemoClaw: created on v0.0.119, upgraded to v0.0.120
OpenClaw: 2026.7.1
```

## Steps to Reproduce

1. Install the previous release, which still ships the Shields commands:

```bash
curl -fsSL https://www.nvidia.com/nemoclaw.sh | NEMOCLAW_INSTALL_TAG=v0.0.119 bash
```

2. Create an OpenClaw sandbox and place a marker file inside it so user data is identifiable:

```bash
nemoclaw onboard --agent openclaw --name {sandbox} --fresh --yes --no-gpu
```

then write a marker file under the sandbox's agent configuration directory.

3. Enable Shields so the release writes its own state record:

```bash
nemoclaw {sandbox} shields up
```

4. Confirm the record exists. The file is named for the sandbox under the NemoClaw state directory and is written by the product, not by hand.

5. Upgrade to the release that retires Shields:

```bash
curl -fsSL https://www.nvidia.com/nemoclaw.sh | NEMOCLAW_INSTALL_TAG=v0.0.120 bash
```

6. Follow the guidance the upgrade prints. Try each named path and record the exit codes:

```bash
nemoclaw {sandbox} rebuild --yes
nemoclaw onboard --name {sandbox} --recreate-sandbox --yes --non-interactive
```

7. Check whether the sandbox is still usable and whether the legacy record is still present.

## Expected Result

At least one of the two paths the product names actually migrates the sandbox: it completes, retires the legacy Shields record, preserves the trusted user data, and leaves the sandbox usable on the current release. If neither path can migrate such a sandbox, the message should say so and name the supported action instead of pointing at two commands that both refuse.

## Actual Result

Both named paths refuse with the same message and change nothing.

```text
nemoclaw {sandbox} rebuild --yes exit 1
nemoclaw onboard --name {sandbox} --recreate-sandbox exit 1
```

Both print:

```text
Shields has been retired from NemoClaw. This release has no Shields commands or supported
Shields posture. Affected sandbox records: {sandbox}. Back up trusted user data and rebuild
or recreate affected sandboxes with the current version.
```

The rebuild attempt additionally reports:

```text
Sandbox recreate error: Sandbox {sandbox} has a state record from the removed Shields
feature. Its current mutable posture cannot be proven.
Incomplete snapshot retained for manual recovery: {backup path}
```

After both attempts the sandbox still reports Phase Ready and the legacy Shields record is still present, so nothing advanced.

Only destroy succeeds:

```text
nemoclaw {sandbox} destroy --yes exit 0
```

That removes the sandbox and clears the record, which is the opposite of the "back up trusted user data and rebuild or recreate" instruction.

The upgrade run itself also reported a failed backup for the same sandbox:

```text
{sandbox}: backup failed (credentials (permission denied))
```

## Logs

```text
Upgrade output:

Shields has been retired from NemoClaw. This release has no Shields commands or supported
Shields posture. Affected sandbox records: {sandbox}. Back up trusted user data and rebuild
or recreate affected sandboxes with the current version.
Backing up {sandbox}...
{sandbox}: backup failed (credentials (permission denied))

Rebuild attempt:

Rebuild sandbox {sandbox}
Incomplete snapshot retained for manual recovery: {backup path}
exit 1
```

Start by tracing the upgrade boundary and the `rebuild` and `onboard --recreate-sandbox` entry points, then inspect how the retired Shields state record is checked and how backup failures are handled. Reproduce the v0.0.119-to-v0.0.120 scenario and add coverage showing that at least one documented recovery path migrates the sandbox, preserves trusted data, clears the legacy record, and leaves it usable.

Written by the indexing model from the issue text.