Selecting Tavily for OpenClaw fails because NemoClaw does not install its plugin

## Problem

A user can select Tavily web search for OpenClaw, but NemoClaw does not install the `@openclaw/tavily-plugin` package that implements that selection. NemoClaw then generates an enabled `plugins.entries.tavily` entry, and the image build requires `openclaw plugins inspect tavily` to succeed. The selected feature cannot provide Tavily search. Depending on where OpenClaw detects the missing plugin, the image build can fail or the sandbox can start with an invalid plugin reference.

This defect is separate from #10331. That PR fixes neutral managed images, where the user did not select Tavily, by omitting the unnecessary plugin entry.

## Why this is a problem

- NemoClaw offers an OpenClaw onboarding choice that cannot produce working Tavily search.
- The generated configuration enables code that is absent from the image.
- A user can provide a valid Tavily credential and still receive a build failure or nonfunctional provider.
- The missing installation has no package pin, integrity check, dependency review, or runtime qualification.

## Current behavior

When OpenClaw web search is explicitly enabled with Tavily:

- `scripts/generate-openclaw-config.mts` creates an enabled `plugins.entries.tavily` entry.
- The Tavily branch in `Dockerfile` runs `openclaw plugins inspect tavily --json` but does not install the plugin first.
- The managed-image capability union installs reviewed Diagnostics OTEL and Brave packages, but not Tavily.

## Triage decision needed

Decide which OpenClaw product contract NemoClaw intends to support:

1. Keep Tavily as a supported selectable provider and define where its reviewed package is installed, pinned, integrity-checked, upgraded, and runtime-qualified.
2. Remove or defer Tavily from the supported OpenClaw selection path until those requirements are accepted.
3. Define another supported activation model with equivalent dependency integrity and runtime validation.

This decision must remain separate from the neutral-image warning fix in #10331.

## Acceptance criteria

If Tavily remains supported for OpenClaw:

- [ ] The selected-provider build installs or otherwise supplies the reviewed Tavily plugin before configuration enables it.
- [ ] The package version, source, integrity, dependency review, license review, and vulnerability disposition are recorded.
- [ ] Generated Tavily configuration passes the pinned OpenClaw validator.
- [ ] Runtime validation proves that an explicitly selected Tavily provider performs search through the intended credential and network-policy boundaries.
- [ ] Neutral managed images remain free of uninstalled Tavily configuration entries.
- [ ] Rebuild and upgrade behavior preserves the supported plugin state without downloading unreviewed runtime code.

If Tavily is deferred, onboarding and non-interactive configuration must reject or omit the unsupported OpenClaw selection. Hermes-specific Tavily support must remain unchanged.

## Related work

- #10331 — omit the uninstalled Tavily entry from neutral managed images
- #10325 — user-visible warning caused by the neutral entry
- #10694 — broader OpenClaw 2.0 migration and official plugin-cohort work