[All Platforms][Sandbox] recover exits 0 despite reporting failure when the sandbox is absent from the live gateway

## Description
`nemoclaw {sandbox} recover` prints a correct, honest failure diagnostic when the sandbox's
container is absent from the live OpenShell gateway (identifies the sandbox as registered
locally but not present live, states the local registry entry was preserved, and points the
user to `rebuild` or `destroy`/`onboard`) -- but the process exits 0 instead of nonzero. A
script or CI wrapper branching on exit status alone cannot tell this failure apart from a
genuine successful recovery.

Platform scope: Reproduced on DGX Spark only this session; other platforms not tested for this
path this pass.
Regression: Unknown -- earlier releases not tested for this path.
OpenShell issue: No. The failing command is NemoClaw's own recover command.

## Environment
Device: DGX Spark (GB10, aarch64)
OS: Ubuntu 24.04
Architecture: aarch64
Node.js: v22.22.1
npm: 10.9.4
Docker: 28.3.3
OpenShell CLI: 0.0.106
NemoClaw: v0.0.122
OpenClaw: 2026.7.1

## Steps to Reproduce
1. Onboard an OpenClaw sandbox and let it reach Ready.
2. Identify its runtime container: `docker ps --filter label=openshell.ai/sandbox-name={sandbox} --format '{{.ID}}'`.
3. Remove the container entirely: `docker rm -f {container-id}`.
4. Run `nemoclaw {sandbox} recover; echo EXIT=$?` in a single shell invocation (no pipes, no race).

## Expected Result
`recover` exits nonzero, since the sandbox could not be recovered (it is absent from the live
gateway) -- the printed diagnostic already correctly says this.

## Actual Result
EXIT=0.

Full output:
Sandbox '{sandbox}' is registered locally, but is not present in the live OpenShell gateway.
Your local registry entry has been preserved -- nothing was removed.
If the live sandbox is stuck mid-provision, retry `nemoclaw {sandbox} rebuild --yes` once it
reappears to recreate it (workspace state is preserved when the live sandbox still exists).
If the sandbox was intentionally deleted, run `nemoclaw {sandbox} destroy` to remove the stale
local entry, or `nemoclaw onboard` to create a new one.
Probe timing: ... result=failed failedStage=gateway

The command's own probe receipt says `result=failed`, and the printed text is unambiguously a
failure message -- but the process exit code is 0.

## Logs
Not captured beyond the exact CLI output shown above (single command, `echo EXIT=$?` in the same
shell invocation, no race condition possible).

Begin at the `nemoclaw {sandbox} recover` CLI entry point and trace how the gateway probe receipt's `result=failed` is translated into the process exit status. Reproduce with the listed container-removal steps, then verify the command returns nonzero for the absent-live-sandbox case while preserving the diagnostic and local registry entry.

Written by the indexing model from the issue text.