[Ubuntu 24.04][Onboard] Hermes onboarding fails and rolls back when the declared port 8642 forward does not start

> [!WARNING]
> **Regression** — fixed in v0.0.65, reproduced again in v0.0.121.

## Description

Hermes onboarding creates the sandbox but fails while starting the declared OpenAI-compatible API forward on host port 8642. The host endpoint remains unreachable, onboarding exits non-zero, and the newly created sandbox is rolled back.

Platform scope: Reproduced on Ubuntu 24.04 GPU only; other platforms have not been tested for this exact v0.0.121 path.

Regression: Yes — fixed in v0.0.65 by [#5389](https://github.com/NVIDIA/NemoClaw/pull/5389), reproduced again in v0.0.121.

OpenShell issue: Unknown — the user-visible failure occurs in NemoClaw onboarding while coordinating an OpenShell forward.

## Environment

```text
Device: Ubuntu 24.04 GPU test host
OS: Ubuntu 24.04
Architecture: x86_64
Node.js: v22.23.2
npm: 10.9.8
Docker: 29.5.2
OpenShell CLI: 0.0.106
NemoClaw: v0.0.121
Hermes Agent: installed by the v0.0.121 release
```

## Steps to Reproduce

1. Install NemoClaw v0.0.121 with Hermes selected.
2. Run non-interactive Hermes onboarding with NVIDIA Endpoints and the default Nemotron model.
3. Allow onboarding to create the Hermes sandbox.
4. Observe the attempt to establish the OpenAI-compatible API forward on port 8642.
5. Probe `http://127.0.0.1:8642/health` and inspect the sandbox after onboarding exits.

## Expected Result

Onboarding completes, the sandbox remains registered and ready, and the declared host forward on port 8642 responds successfully.

## Actual Result

Onboarding reports that the port 8642 forward did not start. The host health probe returns connection refused. Onboarding exits non-zero and the sandbox created earlier in the same run is no longer present.

## Logs

```text
Port 8642 forward did not start.
curl http://127.0.0.1:8642/health: connection refused
The onboarding command exits with status 1 after sandbox creation.
```

## Related Issue

[#5206](https://github.com/NVIDIA/NemoClaw/issues/5206) was fixed by [#5389](https://github.com/NVIDIA/NemoClaw/pull/5389) and released in v0.0.65. This report records the fresh v0.0.121 regression.

Reproduce Hermes onboarding on the stated Ubuntu 24.04 GPU environment with NemoClaw v0.0.121, then inspect the onboarding path that coordinates the OpenShell forward and the port 8642 health probe. Compare the regression with the fix in #5389. Done means onboarding exits successfully, the sandbox remains registered, and http://127.0.0.1:8642/health responds.

Written by the indexing model from the issue text.