Route plugin snapshot restore through the shared transfer adapter

## Outcome

Migrate plugin snapshot restore's host-to-sandbox copy and transfer-dependent repair commands through the same typed OpenShell implementation used by #11496. Preserve restore results and best-effort repair order.

## Accepted scope

Decision: Accept, carrying forward capability slice 3 from the accepted #9810 plan. This consumer is explicitly outside #11496 under #9802's partial-delivery rule. Accountable maintainer and implementation owner: @rsliter.

The reason is completion of the existing transfer adapter migration. Reuse the CLI implementation through a package-compatible boundary; do not duplicate transport logic in the plugin. Snapshot policy, ownership-repair decisions, and restore result mapping stay with the existing plugin owner. No new integration, transport, credential model, or public guarantee is introduced.

## Consumer and acceptance evidence

- `restoreIntoSandbox` in `nemoclaw/src/blueprint/snapshot.ts`, including transfer-dependent legacy-link and ownership repair commands.
- Missing snapshot input or failed copy retains the unsuccessful restore result. Successful copy preserves legacy-link repair followed by ownership repair and their existing best-effort failure behavior.
- Carry asynchronous completion through callers without detached work or premature resource release. Use typed fakes for copy failure and repair ordering, existing snapshot regression tests, and package-contract tests for plugin loading and the installed shared boundary.
- Preserve credential filtering and existing output policy. No raw credential-bearing payloads or exceptions in typed diagnostics. Do not add retries, rollback, snapshot consistency claims, or new ownership policy.
- Snapshot creation, formats, sanitization, and restore lifecycle policy remain unchanged. Refresh overlapping snapshot work before implementation.

## Dependencies and completion

Reuse #11496's typed transfer implementation and existing typed command/SSH contracts. Run focused tests, CLI/plugin type checking as applicable, local review, and PR validation. Use narrowly scoped sandbox evidence only where required to prove changed ownership or copy behavior. Link the implementation PR and evidence here and record final consumer disposition in #9813. #9810 remains the originating capability issue; this follow-on owns the implementation listed above.