[DGX Spark][Inference] OpenRouter runtime adapter binds all interfaces instead of loopback

## Description

After a successful Hermes onboard with the OpenRouter provider, the managed OpenRouter runtime adapter listens on all host interfaces at port 11437 instead of binding only to loopback.

The adapter health check, credential redaction, unauthenticated-request rejection, and a real authenticated inference request all pass. The only failing contract is the host listener address, so this is not an endpoint, credential, runner, or setup failure.

The adapter still enforces its API-key boundary, but binding to every interface unnecessarily widens the network surface of a host-side credentialed service.

- Platform scope: DGX Spark; other platforms have not yet been isolated for this exact listener check
- Regression: Unknown; earlier releases were not tested for this exact listener behavior
- OpenShell issue: No. The listener belongs to the NemoClaw-managed OpenRouter runtime adapter

## Environment

```text
Device: DGX Spark
OS: Ubuntu Linux
Architecture: aarch64
Node.js: v22.23.2
npm: 10.9.8
Docker: 29.2.1
OpenShell CLI: 0.0.106
NemoClaw: v0.0.122
OpenClaw: Not applicable
Agent: NemoHermes
```

## Steps to reproduce

1. Install NemoClaw v0.0.122 on a DGX Spark.
2. Onboard Hermes non-interactively with the OpenRouter provider, a valid API key, and a currently available model.
3. Confirm onboarding succeeds and the runtime adapter health endpoint reports status ok.
4. Send a real authenticated chat-completions request through the adapter and confirm it succeeds.
5. Inspect the host listener for port 11437 with `ss` or an equivalent socket tool.

## Expected result

The OpenRouter runtime adapter listens only on a loopback address such as `127.0.0.1:11437`. The adapter remains reachable through the product's intended routing path without exposing its host port on every interface.

## Actual result

The adapter is healthy and functional, but the host listener is:

```text
LISTEN 0 511 0.0.0.0:11437 0.0.0.0:*
```

The same run confirms that a request without the adapter API key is rejected and that a valid authenticated inference request succeeds. Only the bind-address contract fails.

## Logs

```text
Adapter health: status ok, adapter openrouter-runtime
Authenticated inference: HTTP 200
Request without adapter key: rejected
Credential redaction check: passed
Listener check: adapter bound to 0.0.0.0:11437
```

Locate the NemoClaw-managed OpenRouter runtime adapter entry point and trace how it starts its listener on port 11437. Reproduce the adapter flow, inspect the socket with ss, and consider the issue done when it listens on loopback while health, authentication, credential redaction, and inference checks still pass.

Written by the indexing model from the issue text.