[Ubuntu 26.04][Onboard] --fresh cannot reclaim a pre-create route reservation after a custom image build failure

## Description

When onboarding fails during the sandbox image build - before any sandbox is created -
the failed session leaves an inference route reservation behind. Retrying the same
onboarding command with --fresh is then refused because that reservation belongs to the
previous session, and --fresh does not reclaim it. The sandbox name becomes unusable and
the practical workaround is to pick a different name.

Scope note: this is only about the pre-create case, where no sandbox was ever created and
only a route reservation remains. It is not about a created sandbox whose retained
recovery record blocks --fresh; that is intended safety behaviour and is out of scope
here.

This symptom was previously reported as GitHub issue #11051 and marked fixed. It still
reproduces on v0.0.121 through the custom-Dockerfile build-failure path described below.

Platform scope: Reproduced on Ubuntu 26.04 and Ubuntu 25.04 x86_64; other platforms not
tested.
Regression: Unknown - the earlier report was believed fixed, but the fix was not verified
against this build before this run.
OpenShell issue: No

## Environment

```text
Device: Ubuntu 26.04 host, x86_64 (also seen on Ubuntu 25.04 x86_64)
OS: Ubuntu 26.04 LTS
Architecture: x86_64
Node.js: v22.23.2
npm: Not on PATH (installer-managed Node.js)
Docker: Docker version 29.7.2, build a7dcaa6
OpenShell CLI: openshell 0.0.106
NemoClaw: nemoclaw v0.0.121
OpenClaw: 2026.7.1
```

## Steps to Reproduce

```bash
1. Create a working directory and write a Dockerfile whose final build step fails. It
must declare the tool-disclosure build contract or the build is refused before it
starts:

WORKDIR="$(mktemp -d)"
printf '%s\n' \
'FROM ubuntu:24.04' \
'ARG NEMOCLAW_TOOL_DISCLOSURE=progressive' \
'ENV NEMOCLAW_TOOL_DISCLOSURE=$NEMOCLAW_TOOL_DISCLOSURE' \
'RUN echo "STDOUT_SENTINEL_ABC"' \
'RUN exit 1' > "${WORKDIR}/Dockerfile"

2. Onboard from that Dockerfile and let the build fail:

nemoclaw onboard --from "${WORKDIR}/Dockerfile" --name pilot-bf \
--non-interactive --fresh --yes

3. Immediately retry the exact same command, including --fresh:

nemoclaw onboard --from "${WORKDIR}/Dockerfile" --name pilot-bf \
--non-interactive --fresh --yes

4. Run:

nemoclaw list
```

## Expected Result

--fresh reclaims a route reservation left behind by the same user's own failed pre-create
attempt, so the same sandbox name can be retried.

## Actual Result

Step 3, verbatim:

Error: Cannot replace sandbox 'pilot-bf': its inference route reservation belongs to
another onboarding session

Onboarding did not finish. Resume from the step that failed with:
nemoclaw onboard --resume
Completed steps are skipped; pass --fresh instead to start over.

The guidance suggests passing --fresh, which is what was already passed.

Step 4, verbatim:

pilot-bf interrupted at sandbox
NemoClaw reserved the inference route but did not register the sandbox.
Resume with `nemoclaw onboard --resume`.

No sandbox was ever created by the failed attempt. Choosing a different sandbox name
works and is the only practical way forward.

## Logs

```text
Not captured beyond the terminal output quoted in Actual Result.
```

Start at the `nemoclaw onboard` CLI entry point and trace how pre-create inference route reservations are handled when the custom Dockerfile build fails. Reproduce with the Dockerfile and commands in the issue; done means retrying the same name with `--fresh` succeeds and `nemoclaw list` no longer shows an unusable reservation-only session.

Written by the indexing model from the issue text.