fix(e2e): restore the Docker gateway before sandbox recovery

## Investigation Summary

- The managed-image activation check onboarded and exercised OpenClaw before the restart phase failed.
- The fixture stopped a host PID gateway on a runner with no supported user service.
- Recovery called `nemoclaw mi-act-openclaw status`, which observed the stopped gateway but did not restart it.
- OpenShell then returned connection refused for all 60 health probes. The same signature occurred on two PR commits.
- No open issue or pull request owns this exact restart failure.

## Description

The managed-image activation fixture does not restart a Docker-driver gateway when the fixture receives both a prior PID runtime and a sandbox name.

Expected behavior: the fixture restores the same runtime owner that it stopped. It must restart an exact user service when one was stopped, start a prior PID gateway through the host status path, and retain sandbox-specific recovery for provider-owned container runtimes.

This is a test-fixture repair. It does not change production gateway behavior or weaken the required managed-runtime activation check.

## Reproduction Steps

1. Run the `PR exact all-agent managed runtime activation` check on Linux with the Docker driver and no supported OpenShell user service.
2. Complete managed OpenClaw onboarding and the first agent turn.
3. Enter the fixture's gateway restart phase.
4. Observe that the fixture stops the PID gateway and calls `nemoclaw status`.
5. Observe connection refused until the health deadline, followed by cleanup failure because OpenShell remains unreachable.

Failure evidence: [workflow run 34731310442, job 103657321518](https://github.com/NVIDIA/NemoClaw/actions/runs/34731310442/job/103657321518).

## Environment

- GitHub-hosted Linux x86_64 runner
- Node.js 22.19.0 and npm 10.9.3
- OpenShell 0.0.116 with Docker
- Candidate NemoClaw commit `c62c9111c2fb7bf88b953b93f27f6a8be335e65c`
- Managed OpenClaw 2026.7.1 image

## Debug Output

```text
gateway did not become healthy after restart: openshell status failed
tcp connect error
Connection refused (os error 111)
```

The service diagnostic reported no installed user unit. The prior runtime was the Docker-driver PID gateway.

## Scope and Acceptance Criteria

- Restart a stopped exact user service before any status fallback.
- When the prior runtime is a PID, invoke the host status path that starts the Docker-driver gateway.
- Preserve sandbox-specific status recovery for provider-owned container runtimes.
- Do not select a different runtime provider or suppress a restart failure.
- Add deterministic tests for service, PID, and container runtime ordering.
- Run the existing E2E-support lifecycle suite.
- Require the real managed-image activation check before merge.

## Related Work

- #7744 owns buildless managed onboarding and its all-agent activation evidence.
- #11526 added exact user-service stop and restart handling. This issue covers the remaining no-service PID fallback.
- #11635 covers a different managed-startup file ordering failure.

## Checklist

- [x] I confirmed this bug is reproducible
- [x] I searched existing issues and this is not a duplicate