[WSL2][Onboard] Docker credential-helper bypass ignores explicit DOCKER_CONTEXT during managed sandbox image pull

## Description

When a user explicitly sets a non-default `DOCKER_CONTEXT` alongside a broken WSL2 Docker Desktop credential store, NemoClaw's credential-free bypass still activates during the managed sandbox image pull, even though the effective Docker context was confirmed non-default at the time.

Platform scope: Reproduced on WSL2 only; other platforms not tested (this code path is WSL2/Docker-Desktop specific by design).
Regression: Unknown — earlier versions not tested for this specific scenario.

## Environment

```text
Device: WSL2 (Windows host), Docker Desktop WSL2 backend
OS: Ubuntu 24.04 (WSL2 guest)
Architecture: x86_64
Node.js: v22.23.2
npm: 10.9.8
Docker: 29.7.2
OpenShell CLI: 0.0.106
NemoClaw: v0.0.122
OpenClaw: 2026.7.1
```

## Steps to Reproduce

1. On a WSL2 host with Docker Desktop's WSL integration and an ambient `~/.docker/config.json` whose `credsStore` names the Docker Desktop helper (unresponsive to a read-only probe from this WSL session), create an isolated Docker config directory naming an arbitrary broken `credsStore`:
```bash
TEST_DOCKER_CONFIG=$(mktemp -d)
printf '{"credsStore":"missing-helper"}' > "$TEST_DOCKER_CONFIG/config.json"
```
2. Create an explicit Docker context:
```bash
DOCKER_CONFIG="$TEST_DOCKER_CONFIG" docker context create qa-explicit-host --docker host=unix:///var/run/docker.sock
```
3. Confirm Docker itself reports the non-default context under these env vars:
```bash
DOCKER_CONTEXT=qa-explicit-host DOCKER_CONFIG="$TEST_DOCKER_CONFIG" docker context show
# prints "qa-explicit-host"; `docker context ls` shows "qa-explicit-host *" as current, not "default"
```
4. Run:
```bash
DOCKER_CONTEXT=qa-explicit-host DOCKER_CONFIG="$TEST_DOCKER_CONFIG" nemoclaw {sandbox} rebuild --yes
```

## Expected Result

Since the effective Docker context is confirmed non-default (`qa-explicit-host`, not `default`), NemoClaw should leave the user's explicit Docker configuration untouched and not activate the credential-free bypass.

## Actual Result

NemoClaw still printed:

```text
Docker Desktop credential helper is unavailable in this WSL session; using an isolated credential-free config for the managed sandbox image pull.
```

The bypass fired even though the effective Docker context was independently confirmed non-default via `docker context show`/`ls` under the identical environment variables.

The rebuild itself completed (exit 0), so the impact today is silently overriding the user's explicit Docker configuration for the image-pull step rather than a hard failure.

## Logs

```text
[6/8] Creating sandbox
──────────────────────────────────────────────────
Registry entry exists for '{sandbox}' but installer restore flag not set — skipping pre-upgrade backup select.
Creating sandbox '{sandbox}' (this takes a few minutes on first run)...
Docker Desktop credential helper is unavailable in this WSL session; using an isolated credential-free config for the managed sandbox image pull.
Building sandbox image...
Waiting for sandbox to become ready...
✓ Sandbox '{sandbox}' created
```