Sandbox GPU probe times out pulling the managed image; pre-pull from #10124 only runs on Docker Desktop WSL

### Investigation Summary

Problem: on Jetson (Linux, JetPack 7.2.1), `nemoclaw onboard` fails at [6/8] Creating sandbox on a first install. The sandbox GPU-mode probe runs `docker create --runtime nvidia ` with a 30 s timeout. The managed image is not cached yet, the implicit pull is killed at 30 s, and NemoClaw reports a misleading "Docker did not accept the Jetson NVIDIA runtime GPU mode" error.

This exact bug was already found and fixed on Windows: #10105 reported it on Docker Desktop WSL in August, and #10124 fixed it by pre-pulling the image before the probe. But that fix is gated on `dockerDesktopWsl`, so it never runs on Linux hosts. Jetson uses the same `--runtime nvidia` compatibility route and still hits the original bug.

### Description

Same root cause as #10105, on Jetson: the GPU-mode probe (`docker create --runtime nvidia @ true`, 30 s timeout, pull policy "missing") pulls the managed image on first install and gets killed:

Error: Docker did not accept the Jetson NVIDIA runtime GPU mode for managed bootstrap.
Attempts: --runtime nvidia (NVIDIA_VISIBLE_DEVICES=all): Unable to find image '...openclaw-sandbox@sha256:a041cacf77f8...' locally ... Pull complete ... spawnSync docker ETIMEDOUT

The NVIDIA runtime is registered and preflight passes. #10124 added a pre-pull before the probe, but `prepareDockerManagedBootstrapGpuProbeImage` in `managed-bootstrap/docker-runtime.ts` only runs when `dockerDesktopWsl` is true. Jetson takes the same compatibility route and is not covered.

### Reproduction Steps

1. Fresh JetPack 7.2 flash, install NemoClaw.
2. `nemoclaw onboard`, OpenClaw + Local Ollama, defaults.
3. [6/8] fails after ~60 s with the error above. `--resume` fails the same way.

### Environment

Jetson AGX Orin 64 GB, JetPack 7.2.1 (L4T R39.2.1), arm64
Docker 29.8.0 (runtimes: runc, nvidia),
Node v22.23.2,
openshell 0.0.106
NemoClaw ,
OpenClaw agent,
Local Ollama

### Debug Output

[1/8] Preflight checks
──────────────────────────────────────────────────
[resume] Skipping preflight (cached)
✓ Docker daemon: server 29.8.0
✓ Docker NVIDIA runtime detected for Jetson/Tegra sandbox GPU
✓ Docker can start bridge containers
✓ Docker container DNS resolution works
NVIDIA Jetson/Tegra GPU detected; enabling sandbox GPU through Docker NVIDIA runtime. Use --no-gpu to opt out.

[2/8] Starting OpenShell gateway
──────────────────────────────────────────────────
[resume] Skipping gateway (running)

[3/8] Configuring inference provider
──────────────────────────────────────────────────
[resume] Skipping provider_selection (ollama-local / qwen3.5:9b)
[resume] Reusing sandbox name: mysandbox1.

[4/8] Setting up inference provider
──────────────────────────────────────────────────
[resume] Skipping inference (ollama-local / qwen3.5:9b)
[resume] Reusing web search selection: disabled.

[5/8] Messaging channels
──────────────────────────────────────────────────
[resume] Reusing messaging selection: no channels.
[resume] Reusing OpenShell default resources.

[6/8] Creating sandbox
──────────────────────────────────────────────────
Registry entry exists for 'mysandbox1' but installer restore flag not set — skipping pre-upgrade backup select.
⏳ Still working on Sandbox creation… (30s elapsed)
Jetson sandbox GPU enabled; using NVIDIA Container Runtime instead of CDI/--gpus.
Creating sandbox 'mysandbox1' (this takes a few minutes on first run)...
✓ Updated provider ollama-local

⏳ Still working on Sandbox creation… (62s elapsed)
Error: Docker did not accept the Jetson NVIDIA runtime GPU mode for managed bootstrap. Attempts: --runtime nvidia (NVIDIA_VISIBLE_DEVICES=all): Unable to find image 'ghcr.io/nvidia/nemoclaw/openclaw-sandbox@sha256:a041cacf77f8...' locally ghcr.io/nvidia/nemoclaw/openclaw-sandbox@sha256:a041cacf77f8...: Pulling from nvidia/nemoclaw/openclaw-sandbox 20051f4c4206: Pulling fs layer 570fa881 ... [layer progress lines omitted] ... 9c8912f050a7: Pull complete 55fb7358eaf9: Download complete feff3e10ed80: Download complete spawnSync docker ETIMEDOUT

Onboarding did not finish. Resume from the step that failed with:
nemoclaw onboard --resume

### Logs

```shell

```

### Checklist

- [x] I confirmed this bug is reproducible
- [x] I searched existing issues and this is not a duplicate

Start in managed-bootstrap/docker-runtime.ts, especially prepareDockerManagedBootstrapGpuProbeImage and the dockerDesktopWsl condition, then compare the existing #10124 pre-pull path with the Jetson NVIDIA runtime probe. Reproduce on a fresh JetPack install or inspect the reported 30-second timeout. Done means the managed image is available before the probe on Jetson and nemoclaw onboard completes sandbox creation without the misleading runtime error.

Written by the indexing model from the issue text.