[DGX Station][macOS][CLI&UX] config export still fails for every sandbox on the default NVIDIA hosted provider on v0.0.122, now at the sandbox-inventory check

> [!NOTE]
> **Re-verified reopening of #11154** — closed via #11318, whose merge commit is
> confirmed an ancestor of `v0.0.122`. Re-verification on `v0.0.122` still
> reproduces the original symptom. The fix is present in the installed build
> (the old generic wording is gone and the new per-check reason strings ship),
> so this is a FAIL against a build that carries it, not a stale install.

## Description

`nemoclaw config export` still exits 2 for every sandbox onboarded against
NVIDIA's hosted inference provider — the default onboarding path — on
`v0.0.122`.

#11318 states its outcome as: "`nemoclaw config export` can export a managed
OpenClaw sandbox using the native `nvidia-prod` hosted provider with its
default endpoint." That is exactly the configuration tested below, and it does
not export.

What the fix did change: the failure is now attributed to a specific check.
The generic message quoted in #11154 ("Required live source state could not be
read or verified") is gone; the build ships per-check reasons and the command
now reports `The live sandbox inventory could not be read or verified.` So the
diagnosability half improved and the failing check has moved — the remaining
blocker is the sandbox inventory, not the inference provider metadata that
#11318 addressed.

## Environment

```text
Device: NVIDIA DGX Station GB300 / Apple Silicon Mac
OS: Ubuntu 24.04.4 LTS / macOS 26.5
Architecture: aarch64 / arm64
Docker: 29.2.1 / 29.5.2
OpenShell CLI: openshell 0.0.106
NemoClaw: v0.0.122
OpenClaw: 2026.7.1
```

## Steps to Reproduce

1. Onboard one OpenClaw sandbox against the hosted NVIDIA provider, leaving the
default provider selection:

```bash
nemoclaw onboard --non-interactive --yes --fresh --no-gpu --name
```

2. Confirm the sandbox is healthy and its live route matches the registry:

```bash
nemoclaw status
openshell inference get
```

3. Export to a file, and record the exit code:

```bash
nemoclaw config export --output
```

4. Export to standard output, and record both stream sizes:

```bash
nemoclaw config export --output -
```

## Expected Result

Export exits 0 and writes one canonical YAML document describing the sandbox.

## Actual Result

Both forms fail identically, on both platforms:

```text
Config export failed (live-verification-failed).
The live sandbox inventory could not be read or verified.
exit code 2
```

No file is created; the stdout form writes 0 bytes to stdout and 109 bytes to
stderr.

Tested on 2 hosts / 3 sandboxes, all provider `nvidia-prod`, model
`nvidia/nemotron-3-super-120b-a12b`:

| # | Host | Sandbox | Result |
|---|---|---|---|
| 1 | DGX Station | created on this release, isolated gateway port | exit 2 |
| 2 | DGX Station | freshly onboarded on the default gateway (onboard rc=0) | exit 2 |
| 3 | macOS | freshly onboarded on a clean install of this release (rc=0) | exit 2 |

Every sandbox was healthy at export time:

```text
Phase: Ready
Inference: healthy (https://inference.local/v1/models)
Inference (route reachability): reachable
Inference (upstream): healthy (https://integrate.api.nvidia.com/v1/chat/completions)
openshell inference get -> provider nvidia-prod, model nvidia/nemotron-3-super-120b-a12b
```

`openshell provider list` still shows the provider registered with a different
type and no configuration keys, as in the original report:

```text
NAME TYPE CREDENTIAL_KEYS CONFIG_KEYS
nvidia-prod nvidia 1 0
```

## Fix-in-build check

| PR | Merged | Ancestor of v0.0.122 |
|---|---|---|
| #11318 `fix(config): export native NVIDIA hosted inference` | 2026-09-09 | yes |
| #11345 `refactor(config): export SDK policy and tighten adapter checks` | 2026-09-10 | yes |
| #11303 `fix(config): isolate tests and complete export E2E selection` | 2026-09-09 | yes |
| #11065 `refactor(config): make export contracts explicit` | 2026-09-09 | yes |

No commit on `main` after the `v0.0.122` tag was cut touches config export or
the inventory check, so this is not expected to resolve itself in the next
build.