Add identity-verified recovery for incomplete external-component activation

## Problem statement

PR #11366 records identity-bound incomplete state and preserves the sandbox when external-component activation fails or is ambiguous. The accepted v1 scope in #11340 intentionally excludes resume, rebuild, recreation, migration, and automatic recovery. An operator therefore has no supported action that completes or retires the preserved state.

## Desired behavior

After a product decision defines the supported recovery action, NemoClaw provides one bounded operator path for an incomplete external-component activation. The path verifies immutable sandbox identity, gateway ownership, and effective policy before it completes activation or retires state. It never selects or deletes a sandbox by mutable name alone.

## Scope and exclusions

Include the recovery contract, lifecycle ownership, state retention, diagnostics, and deterministic validation. Keep NemoClaw as the sole writer and lifecycle owner of its gateway. Preserve the v1 ban on automatic activation retries.

Exclude vendor adapters, integration-specific services, generic command hooks, credential transfer, externally supervised gateways, and any recovery behavior that has not received a product-scope decision.

## Ongoing ownership

NemoClaw onboarding maintainers. Record an accountable owner in the product decision before implementation.

## Placement and support expectations

Core NemoClaw follow-up to the experimental external-component lifecycle in #11340. Support remains limited to the compatibility boundary accepted for that capability unless a later decision expands it.

## Validation plan

- Deterministic tests for activation failure and ambiguity across a later invocation.
- Immutable sandbox identity, managed-gateway ownership, and effective-policy verification before recovery effects.
- No deletion, reuse, or recovery decision based only on a mutable sandbox name.
- Durable evidence retained until the bounded action succeeds.
- Redacted diagnostics and proof that credentials do not enter state, logs, events, arguments, environment variables, or artifacts.
- Stable failure tests for changed identity, changed policy, ambiguous state, and interrupted recovery.

Use live E2E only if a real process, gateway, or sandbox boundary cannot be proven deterministically.

## Compatibility requirements

Initially match #11340: supported Linux installations with a NemoClaw-managed OpenShell gateway. Exclude externally supervised gateways until separately approved.

## Security or privacy impact

Recovery is security-sensitive because it can affect a preserved sandbox. It must bind every effect to immutable identity and verified lifecycle authority, fail closed on ambiguity, and carry no credentials.

## Implementation idea

Extend the existing onboarding state machine, session evidence, identity checks, policy verification, gateway lifecycle, and finalization flow. Do not add a parallel lifecycle manager, registry, state machine, or test harness.

## Category

Feature

## Checklist

- [x] I searched existing issues and this is not a duplicate.
- [x] I described the problem and desired behavior.

Start by locating the existing onboarding state machine, session evidence, identity checks, policy verification, gateway lifecycle, and finalization flow referenced in the issue. First resolve the required product-scope decision and accountable owner; done means one bounded, fail-closed recovery path with deterministic validation, durable redacted evidence, no credential leakage, and no name-only sandbox selection.

Written by the indexing model from the issue text.