Stop rewriting native model and provider configuration after onboarding

Parent: https://github.com/NVIDIA/NemoClaw/issues/11255

## Problem

NemoClaw continues to generate, reconcile, and sometimes rewrite native model/provider configuration after onboarding. Provider aliases, model references, environment values, and dashboard copies can differ from what OpenClaw or Hermes would normally retain, limiting native provider and model features.

## Desired behavior

NemoClaw performs the minimum initial attachment to the selected OpenShell inference route. OpenShell owns credential placement. After attachment, the agent owns its native model and provider configuration, including supported additional providers and model settings.

## Scope

- Remove ongoing NemoClaw provider/model reconciliation, alias resets, whole-config rewrites, and dashboard-specific shadow configuration.
- Keep only the non-secret route/reference values required to connect the initial selected provider through OpenShell.
- Allow native agent interfaces to add and modify providers, models, reasoning settings, context limits, and routing preferences.
- Do not copy OpenShell-held credentials into agent configuration or environment.
- Normalize Hermes and OpenClaw behavior under the same rule.

## Acceptance criteria

- Native provider/model edits persist through restart, reconnect, rebuild, and restore.
- Additional providers supported by the native agent are not rejected or overwritten by NemoClaw.
- Dashboard, CLI, TUI, and agent runtime observe one native configuration rather than NemoClaw-maintained copies.
- OpenShell remains the sole owner of credential storage/projection.
- Obsolete reconciliation and shadow-config code is deleted with its tests.

## Basic-onboarder end state and E2E amendments

The onboarder may attach one initial OpenShell inference route and write the non-secret reference needed for first launch. After that point, native agent configuration owns providers, models, aliases, reasoning settings, limits, and UI presentation. Do not build an ongoing NemoClaw provider reconciler or shadow configuration.

Amend the existing E2E inventory as follows:

- `test/e2e/live/openclaw-inference-switch.test.ts` (`openclaw-inference-switch`): perform provider/model changes through native OpenClaw configuration and verify NemoClaw does not overwrite them; retain OpenShell credential custody.
- `test/e2e/live/hermes-inference-switch.test.ts` (`hermes-inference-switch`): perform the equivalent operation through native Hermes configuration without dashboard or gateway shadow copies.
- `test/e2e/live/inference-routing.test.ts` and `test/e2e/live/inference-routing-provider-smoke.test.ts`: retain route and credential-isolation proof, but remove assertions that require NemoClaw to own ongoing native provider configuration.
- `test/e2e/live/model-router-provider-routed-inference.test.ts`: keep OpenShell route behavior while allowing the agent's native model/provider representation.
- `test/e2e/live/cloud-inference.test.ts` and `test/e2e/live/full-e2e.test.ts` (`full-e2e`): verify initial onboarding works, then verify a native agent-owned setting persists without reconciliation.
- `test/e2e/live/managed-image-activation-e2e.test.ts`: prove agent runtime, CLI/TUI/dashboard, and spawned-agent views use the same native configuration after initial route attachment.

Amend the corresponding inference-switch and hosted-inference support tests. Do not add another provider E2E matrix; remove duplicate NemoClaw reconciliation cases as native ownership replaces them.