0.0.123: "Configure Memory Search" cannot work — Ollama pinned to loopback, managed route has no embeddings, ollama plugin not allowed, sqlite-vec missing, `config set` removed

## Summary
On NemoClaw 0.0.123 an OpenClaw agent can no longer use vector memory search. The shipped page `docs/configure-agents/configure-memory-search.mdx`
tells the operator to reach Ollama from the sandbox at `http://host.openshell.internal:11434` and to write the provider with `nemoclaw config set`.
Both are impossible on 0.0.123, and two more requirements are missing from the managed image. Result: every agent falls back to keyword-only (FTS) memory.

## Environment
NVIDIA Spark (aarch64), Ubuntu; NemoClaw 0.0.123 (tag v0.0.123, rev f75f722b), OpenShell 0.0.106 (docker driver), OpenClaw 2026.7.1,
Ollama 0.34.0 (`ollama-local`, model `gemma4:26b`), managed image `ghcr.io/nvidia/nemoclaw/openclaw-sandbox@sha256:a041cacf…`, sandbox `my-assistant`.

## Reproduction (all from the sandbox unless noted)
1. `nemoclaw my-assistant exec -- curl -fsS http://host.openshell.internal:11434/api/tags`
→ `{"detail":"connection to host.openshell.internal:11434 failed","error":"upstream_unreachable"}`
Host: `/etc/systemd/system/ollama.service.d/override.conf` now contains `OLLAMA_HOST=127.0.0.1:11434`, written by onboarding
(`mergeOllamaLoopbackSystemdOverride`, `src/lib/onboard/ollama-systemd.ts`) and re-applied at every lifecycle command. Before the update it was `0.0.0.0:11434`.
2. `curl https://inference.local/v1/embeddings -H 'Content-Type: application/json' -d '{"model":"qwen3-embedding:4b","input":"x"}'`
→ HTTP 501 `{"error":{"message":"This server does not support embeddings. Start it with `--embeddings`", ...}}`
`curl https://inference.local/api/embed -d '{"model":"qwen3-embedding:4b","input":["x"]}'` → `{"error":"connection not allowed by policy"}`
(`/v1/chat/completions` and `/v1/models` work.)
3. `nemoclaw my-assistant config set …` → the command does not exist on 0.0.123 (`nemoclaw config export ` only).
4. With `models.providers.ollama-mem` (api `ollama`) and `agents.defaults.memorySearch.provider = ollama-mem` configured, the gateway logs:
`memorySearch.provider="ollama-mem" is configured, but no loaded plugin registered a memory embedding provider that can serve "ollama-mem".
Semantic memory recall will fall back to keyword/FTS-only search.` — `openclaw plugins list` shows `@openclaw/ollama … disabled`
(excluded by the image's `plugins.allow`).
5. `node -e 'require("sqlite-vec")'` in the sandbox → `Cannot find module 'sqlite-vec'` (runtime `/usr/local/lib/nemoclaw/openclaw-runtime`).

## Expected
Either the documented procedure works on 0.0.123, or the page states that memory search is unavailable on the managed route and why.

## Suggested fix (any subset helps; all are small)
- Let the managed route carry embeddings: `POST /v1/embeddings` and (for OpenClaw's Ollama provider) `/api/embed` through `inference.local`.
- Allow the bundled `ollama` plugin in the image's `plugins.allow`, or ship an embedding provider for the managed route.
- Ship `sqlite-vec` in the OpenClaw runtime image.
- Update `configure-memory-search.mdx` (see the companion docs PR).
- Related: onboarding writes `OLLAMA_CONTEXT_LENGTH=16384` and `contextWindow: 16384`; an OpenClaw agent's prompt alone is ~9,100 tokens
(system prompt + 24 tools + workspace files) → "Context is too large and auto-compaction could not recover this turn". A 32k floor would avoid that.

## Also observed during the 0.0.109 → 0.0.123 migration (separate issues on request)
- `rebuild --yes` pre-flight upgraded the OpenShell CLI 0.0.101 → 0.0.106 while `nemoclaw-openshell-gateway.service` kept the deleted 0.0.101 binary → "gateway port held by an incompatible owner".
- `rebuild` deleted the sandbox, then refused its own recreate because of `~/.nemoclaw/state/shields-.json` (never listed as a blocking path; `allowRemovedImmutabilityStateRecord` only on the recovery retry).
- The recovery retry failed with "inference route reservation belongs to another onboarding session" (`releaseAbandonedRouteReservation` only releases route-only rows).
- `snapshot restore` refuses snapshots taken by 0.0.109 ("legacy snapshot lacks managed workload and provider runtime authority").
- `gateway.auth.token` is regenerated at every container start (`ensure_gateway_token`); the start script's health loop then keeps the stale token → `[ws] unauthorized … token_mismatch` every 30 s.

Full write-up with outputs: Sparky project knowledge board, findings 0037 and 0039 (attached on request).

Start with docs/configure-agents/configure-memory-search.mdx and reproduce the listed failures from the sandbox. Trace onboarding changes in src/lib/onboard/ollama-systemd.ts, then inspect the managed inference route, plugin allowlist, and OpenClaw runtime image for the missing requirements. Done means the documented procedure works on 0.0.123 or the page clearly explains why managed-route memory search is unavailable.

Written by the indexing model from the issue text.