Managed startup runtime digest test fails after #11317

## Investigation Summary

- The managed startup runtime artifact changed in #11317, but its expected SHA-256 in the integration test did not.
- The focused artifact-pin test fails deterministically: one failure, three passes, and 15 cases excluded by the test filter.
- The failing test and bundle match canonical main `7d687ff7ea490c307b2a9ad2dcf5401967da609b` byte-for-byte.
- This was found while validating #11209. That PR changes neither file.
- Existing PRs #11173, #11163, and #11251 also replace this bundle and update its pin as part of larger changes.

## Description

The integration test rejects the committed `managed-startup-image-runtime.bundle` because its expected digest is stale.
Expected behavior: the reviewed artifact and its independent expected SHA-256 agree, so the artifact-pin test passes.

The change is traceable to #11317, merged as `cad49353438e5ec6fd853eb51a1f6aded84090ff`.
That PR regenerated the bundle while removing redundant Node.js type-stripping flags, but left the test's digest unchanged.
This is a regression in an existing test contract, not a request for a new supported surface.

Relevant source at the verified main revision:

- [Expected digest](https://github.com/NVIDIA/NemoClaw/blob/7d687ff7ea490c307b2a9ad2dcf5401967da609b/test/mcp/mcp-tool-discovery-image-contract.test.ts#L18)
- [Failing assertion](https://github.com/NVIDIA/NemoClaw/blob/7d687ff7ea490c307b2a9ad2dcf5401967da609b/test/mcp/mcp-tool-discovery-image-contract.test.ts#L242)
- [Committed runtime bundle](https://github.com/NVIDIA/NemoClaw/blob/7d687ff7ea490c307b2a9ad2dcf5401967da609b/tools/mcp-tool-discovery-runtime/reviewed-runtime-bundle/managed-startup-image-runtime.bundle)

## Reproduction Steps

In a prepared checkout at the verified main revision, run:

```sh
npx --no-install vitest run --project integration \
test/mcp/mcp-tool-discovery-image-contract.test.ts \
-t 'pins the reviewed image runtime artifacts exactly'
```

The failure was reproduced on `6b75bf3439cbd12621d9db9b38a96b37d3ba365e` with the same test and bundle as main.
GitHub and the local checkout report identical Git blob IDs for both files:

```text
test: 14b9136a3c4a33ef033b107cf23fcc4c1e839e88
bundle: af207af0178bfedb7248c6fad433150d7e1c39bb
```

## Environment

- macOS 26.5.2, arm64
- Node.js 22.23.2; npm 10.9.8; Vitest 4.1.9
- Verified main revision: `7d687ff7ea490c307b2a9ad2dcf5401967da609b`
- The failing assertion compares committed file bytes. It requires no sandbox, inference service, or live E2E run.

## Debug Output

```text
FAIL test/mcp/mcp-tool-discovery-image-contract.test.ts
MCP tool discovery image contract > pins the reviewed image runtime artifacts exactly

Expected: c267456af3ef655f344eea46caa0f23f93b33c88df8b5c290d7fad174346f04c
Received: 17ac7309b4f830947e0fcf88999c2e7b7e95cd67f880c3f6fccfac0aca2aeb6b

test/mcp/mcp-tool-discovery-image-contract.test.ts:242:38
Tests: 1 failed | 3 passed | 15 skipped (19)
Exit code: 1
```

A sandbox debug bundle does not apply to this static artifact-pin failure.

## Acceptance Criteria

- Review the bundle change from #11317 and restore agreement with the independent expected digest.
- The focused command above and the complete `mcp-tool-discovery-image-contract.test.ts` file pass.
- Preserve strict artifact integrity assertions. Do not skip the check or compute the expected digest from the artifact being checked.
- Keep this repair separate from #11209's installer behavior. Coordinate with #11173, #11163, and #11251 before changing their shared pin.

## Related Work

#11173, #11163, and #11251 update the same artifact and expected digest for their own changes.
They are overlapping work, not dedicated repairs for this regression. Recheck their latest revisions before implementing a standalone fix.
#11327 repairs a different main failure involving a gateway teardown mock.

## Checklist

- [x] I confirmed this bug is reproducible.
- [x] I searched existing issues and PRs; no dedicated duplicate was found when filing.

Start with test/mcp/mcp-tool-discovery-image-contract.test.ts at the expected digest and failing assertion, then inspect the managed-startup-image-runtime.bundle change from #11317. Run the focused Vitest command, compare the reviewed bundle with its independently computed SHA-256, and coordinate with #11173, #11163, and #11251 before changing the shared pin. Done means the focused test and the complete contract test pass without weakening the integrity assertion.

Written by the indexing model from the issue text.