[All Platforms][Sandbox] rebuild refuses to recreate a sandbox absent from the live gateway, contradicting documented recovery behavior

## Description
When a sandbox's container has been removed (still registered locally, but absent from the live
OpenShell gateway), `nemoclaw {sandbox} rebuild --yes` does not recreate it. It refuses outright
and instructs the user to `destroy` then re-`onboard` from scratch, discarding the sandbox's
identity and any recovery the documented rebuild flow is supposed to provide for exactly this
scenario.

Platform scope: Reproduced on DGX Spark only this session; other platforms not tested for this
path this pass.
Regression: Unknown -- earlier releases not tested for this path.
OpenShell issue: No. The failing command is NemoClaw's own rebuild command.

## Environment
Device: DGX Spark (GB10, aarch64)
OS: Ubuntu 24.04
Architecture: aarch64
Node.js: v22.22.1
npm: 10.9.4
Docker: 28.3.3
OpenShell CLI: 0.0.106
NemoClaw: v0.0.122
OpenClaw: 2026.7.1

## Steps to Reproduce
1. Onboard an OpenClaw sandbox and let it reach Ready.
2. Identify its runtime container: `docker ps --filter label=openshell.ai/sandbox-name={sandbox} --format '{{.ID}}'`.
3. Remove the container entirely: `docker rm -f {container-id}`.
4. Run `NEMOCLAW_GATEWAY_RECOVERY_WAIT_SECONDS=120 nemoclaw {sandbox} rebuild --yes`.

## Expected Result
`rebuild --yes` recreates the container and waits for post-recreate readiness within the
configured budget, without a premature give-up. `nemoclaw {sandbox} status` then shows the
sandbox Ready.

## Actual Result
Exit code 0, but the sandbox is NOT recreated. Full output:

Sandbox '{sandbox}' is registered locally but absent from the live OpenShell gateway.
Rebuild cannot recover its missing OpenShell policy or live workspace from NemoClaw registry
metadata.
To create a clean replacement:
1. nemoclaw {sandbox} destroy --yes
2. nemoclaw onboard
The missing sandbox's state cannot be recovered unless you have a separate snapshot to restore
after onboarding.
Cannot rebuild an absent sandbox without its authoritative OpenShell policy.

Rebuild refuses to recreate the sandbox at all, contradicting the documented recovery workflow
(remove the container -> rebuild recreates it) for this exact, reproducible scenario.

## Logs
Not captured beyond the exact CLI output shown above.

Start at the `nemoclaw {sandbox} rebuild --yes` entry point and reproduce the missing-container case with the documented Docker removal steps. Trace the absent-gateway handling and recovery wait behavior; done means the command recreates the container, waits within the configured budget, and `nemoclaw {sandbox} status` reports Ready.

Written by the indexing model from the issue text.