nemoclaw download rejects a leading-hyphen sandbox source path as an unknown flag

`nemoclaw download` fails to download a file whose sandbox-relative source path begins with a hyphen (e.g. `-download-root/file.txt`). Instead of treating it as a relative path (per the command's own documented contract), the CLI parses it as an unrecognized flag and aborts. Passing `--` before the path does not help, since the command internally re-invokes `openshell sandbox download`, which independently re-parses the argument and fails the same way one layer down.

Steps to Reproduce:
1. On a Ready sandbox, create a directory with a leading hyphen in its name and a file inside it:
nemoclaw exec -- sh -c 'mkdir -p /sandbox/-download-root && printf "hyphen-ok\n" > /sandbox/-download-root/file.txt'
2. Attempt to download it using the documented relative-path syntax:
nemoclaw download -download-root/file.txt /tmp/dest/hyphen.txt
3. Observe the CLI rejects the path as a flag: "Nonexistent flag: -download-root/file.txt"
4. Attempt the standard shell workaround (-- argument separator):
nemoclaw download -- -download-root/file.txt /tmp/dest/hyphen.txt
5. Observe a different but equally blocking error one layer down: "error: unexpected argument '-d' found"

Expected: a leading-hyphen sandbox source path should be treated as a relative source path, not as a command option.
Actual: both attempts fail; there is no working CLI syntax to download a sandbox source path that begins with a hyphen.

Environment: NemoClaw v0.0.121, OpenShell CLI 0.0.106, Ubuntu 24.04 x86_64, Docker 29.7.2.

Start at the `nemoclaw download` command and trace its internal re-invocation of `openshell sandbox download`; reproduce the failure with `-download-root/file.txt` and with `--`. Done means a sandbox-relative source path beginning with a hyphen downloads successfully to the specified destination.

Written by the indexing model from the issue text.