[Ubuntu 26.04][Onboard] Portable onboard collides with the host Ollama on port 11434

## Description

Portable onboarding starts its own Podman Ollama container bound to `127.0.0.1:11434` and collides with the host Ollama service that is already listening there. Onboarding stops at step `[4/8]` and prints the raw low-level bind error, with no explanation and no guidance.

The collision is not an unusual setup. A running host Ollama is the documented prerequisite for this path, so following the setup instructions is what puts the port in use. The product then fails on the very condition it asked the user to create, and it neither reuses the host Ollama that is already reachable nor reports the situation as a recognizable precondition problem.

The message names only a socket bind failure, so a user has no way to know that a second Ollama was being started, which port matters, or that stopping the host service is what clears it.

- **Platform scope:** Reproduced on Ubuntu 26.04 x86_64 only; other platforms not tested.
- **Regression:** Unknown — earlier versions not tested for this path.
- **OpenShell issue:** No

## Environment

```text
Device: Ubuntu 26.04 host, x86_64, NVIDIA GeForce RTX 5070 Ti
OS: Ubuntu 26.04 LTS
Architecture: x86_64
Node.js: v22.23.1
npm: 10.9.8
Docker: Docker version 29.6.1, build 8900f1d
Podman: podman version 5.7.0
Ollama: ollama version 0.32.9 (host service, active)
OpenShell CLI: openshell 0.0.106
NemoClaw: nemoclaw v0.0.123 (nemohermes v0.0.123)
OpenClaw: N/A (onboard not completed)
```

## Steps to Reproduce

1. On a supported Linux host with rootless Podman and a GPU, install Ollama as the documented prerequisite and confirm the host service is running and holding the default port:

```bash
systemctl is-active ollama
ss -lnt | grep 11434
```

2. Choose an unused non-default gateway port and start Portable Hermes onboarding:

```bash
NEMOCLAW_GATEWAY_PORT=8137 NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1 \
nemohermes onboard --experimental-profile portable --fresh --name hermes-portable-alt
```

3. Watch step `[4/8] Setting up inference provider`.

## Expected Result

Onboarding either reuses the host Ollama that is already running and reachable, or, if it must run its own instance, it detects the port is taken before starting and reports that clearly: which port, what is holding it, and what the user should do.

The setup the product's own prerequisites produce does not cause a failure.

## Actual Result

Onboarding exits 1 at step `[4/8]` with the raw bind error:

```text
[4/8] Setting up inference provider
Podman inference start: Podman inference create did not leave the exact runtime running:
Error: rootlessport listen tcp 127.0.0.1:11434: bind: address already in use
Host-local inference failure [runtime provider 'podman']: Podman inference create did not
leave the exact runtime running: Error: rootlessport listen tcp 127.0.0.1:11434: bind:
address already in use
```

Nothing in the output says a second Ollama was being started, that the host Ollama is what holds the port, or how to proceed. The host Ollama was reachable and answering throughout.

Stopping the host Ollama service let onboarding move past step `[4/8]`, which confirms the host service is what the product's own Ollama container was colliding with.

Observed twice on the same host:

- First occurrence during a Portable Hermes onboarding attempt.
- Second occurrence on a later Portable onboarding run after the product's own previous Ollama container had been left behind and was still holding the port. In that case the product collided with its **own** leftover container rather than the host service, and printed the same raw bind error.

The second occurrence matters because it shows the failure is not limited to a host-service conflict: any existing listener on that port, including one the product itself created earlier, produces the same unexplained error.

## Logs

```text
Not captured beyond the terminal output quoted in Actual Result.
```