[R0] Connect VoiceClaw to one v1 agent with a scoped credential

## Outcome

An operator gives VoiceClaw a private NemoClaw semantic API endpoint and one short-lived credential scoped to one verified v1-deployed OpenClaw agent. VoiceClaw authenticates directly with that credential.

This is the user-selected temporary R0 experiment. It preserves the ownership boundary in `VOICECLAW_NEMOCLAW_API_CONTRACT.md` but deliberately replaces its offer/redemption/attachment-lease mechanism with direct scoped authentication. It does not claim full `v1alpha1` conformance.

## Work

- Expose only the semantic connection/readiness behavior needed for one integration run. Keep native adapters, protocols, IDs and credentials private to NemoClaw/OpenShell.
- Provide an operator-invoked way to issue the scoped credential after verifying #11751's agent/integration state. Bind it to the actual target, including replacement identity, and enforce expiry.
- Deliver the endpoint and credential to VoiceClaw using an owner-only file or protected pipe. Keep the value out of declarative configuration, command arguments and logs.
- Authenticate directly using this credential. Do not create a separate offer resource, redemption endpoint, second attachment credential or lease-recovery protocol.
- Verify actual native-agent readiness and report clear authentication, target and availability failures.
- Limit the proof to one operator-authorized run and connection. On disconnect, expiry or restart, stop the experiment; the operator issues a fresh credential for another run.

## Acceptance

- [ ] VoiceClaw reaches only the intended real agent through the private semantic API.
- [ ] Missing/invalid/expired credentials and wrong or replaced targets are rejected.
- [ ] An unavailable native agent cannot be reported ready.
- [ ] Neither VoiceClaw nor its client receives native protocols, IDs, credentials or arbitrary execution access.
- [ ] The credential is protected and short-lived. Single-use redemption and replay-proof attachment creation are not claimed.

## Deferred

Offer documents/redemption, credential exchange, attachment leases, idempotent attach reconciliation, resumable transport, automated reconnection/renewal, reusable broker identity and durable sessions.

## Dependencies

R0 parent epic: [#11746](https://github.com/NVIDIA/NemoClaw/issues/11746).

VoiceClaw counterpart: [VoiceClaw #7](https://gitlab-master.nvidia.com/jarvis/voice-claw/-/issues/7).

Blocked by:

- [#11747: [R0] Specify the v1-to-VoiceClaw onboarding handoff and scoped connection fixtures](https://github.com/NVIDIA/NemoClaw/issues/11747)
- [#11751: [R0] Apply voice integration intent on v1 and hand off to VoiceClaw onboarding](https://github.com/NVIDIA/NemoClaw/issues/11751)

## Category

Feature

## Concrete R0 wire and onboarding agreement

Implement revision 1, profile `nemoclaw-voice-r0/1`, defined in [NemoClaw #11747](https://github.com/NVIDIA/NemoClaw/issues/11747). That issue contains the full wire specification and a portable shared fixture bundle. Fixture SHA-256: `20132310c2f14dd927b0ac50e30d5176a9e3c99b83d5890c9cf581e2320d3442`. Local shared copy: `~/Development/nemoclaw-voice/contracts/voiceclaw-r0-v1/`.

Provide `POST /r0/connect` with direct scoped Bearer authentication and an NDJSON `ready`/`heartbeat`/`closed` stream. Match the specified statuses, errors, target-generation binding, fifteen-minute credential expiry and failure behavior. No prompt/task/result endpoints are required for R0. Run the shared corpus against the real server using controlled identity, clock and native-adapter fixtures. The mock server itself is not backend qualification.

Start with the revision 1 wire specification and shared fixture bundle in #11747, then review VOICECLAW_NEMOCLAW_API_CONTRACT.md and the dependency state in #11751. Implement and exercise POST /r0/connect against the real server using the shared corpus, controlled identity, clock, and native-adapter fixtures. Done means the specified authentication, target binding, expiry, readiness, heartbeat, closed-stream, and failure behaviors pass without exposing native access.

Written by the indexing model from the issue text.