[WSL2][Onboard] managed llama.cpp onboarding fails with exit 28 on N1x WoA

## Description

NemoClaw v0.0.124 onboarding with managed llama.cpp on N1x Windows on ARM (WoA) via WSL2 + Docker Desktop fails at step 3/8 (Configuring inference provider) with "Docker llama.cpp private loopback bridge probe failed (exit 28)" after approximately 30 seconds. The managed llama.cpp container does not become ready before the probe times out.

Unlike #11436, which failed with exit 7 before PR #11444, this v0.0.124 run reaches the host-side probe and fails with exit 28 after approximately 30 seconds. PR #11444 is included in v0.0.124.

Platform scope: Reproduced on N1x Windows on ARM (WoA) only; other platforms not tested.
Regression: Unknown — earlier versions not tested (the host-process probe path was introduced in v0.0.124 by PR #11444)
OpenShell issue: No

## Environment

```text
Device: N1x Windows on ARM
OS: Windows 11 ARM64 + WSL2 Ubuntu 24.04.4 LTS (microsoft-standard-WSL2 kernel)
Architecture: aarch64
Node.js: v22.23.2
npm: 10.9.8
Docker: Docker version 29.7.2 (Docker Desktop, engine 29.7.2)
GPU: NVIDIA RTX Spark N1X (6144-core Blackwell RTX GPU, 63936 MB)
GPU Driver: NVIDIA-SMI 615.72 / KMD 616.79 / CUDA UMD 13.4
OpenShell CLI: openshell 0.0.116
NemoClaw: nemoclaw v0.0.124
OpenClaw: N/A (onboard not completed)
```

## Steps to Reproduce

1. On N1x Windows on ARM with Docker Desktop and WSL2 Ubuntu-24.04
2. Install NemoClaw v0.0.124:

```bash
curl -fsSL https://www.nvidia.com/nemoclaw.sh | NEMOCLAW_INSTALL_TAG=v0.0.124 bash
```
3. Accept license (yes) and express install (Y)
4. Onboarding proceeds through steps 1-2 successfully (preflight + OpenShell gateway)
5. Step 3/8 selects install-llama-cpp provider, begins pulling managed inference image
6. Wait for onboarding to complete

## Expected Result

Onboarding step 3/8 should complete successfully — the bridge probe should wait long enough for the llama.cpp container to start and the model to load into GPU memory on N1x ARM64 hardware.

## Actual Result

Onboarding fails at step 3/8 with exit 28 (timeout):

```text
[3/8] Configuring inference provider
[non-interactive] Provider: install-llama-cpp
Verifying the exact llama.cpp GGUF in the shared Hugging Face cache
Still working on Provider selection... (30s elapsed)
Pulling pinned managed-inference image ghcr.io/nvidia/nemoclaw/llama-cpp-server@sha256:9d0cddd7bcaf...
Managed llama.cpp install failed: Docker llama.cpp private loopback bridge probe failed (exit 28).
[non-interactive] Aborting: Docker llama.cpp private loopback bridge probe failed (exit 28).

Onboarding did not finish. Resume from the step that failed with:
nemoclaw onboard --resume
```

The failure is reported after approximately 30 seconds while the managed llama.cpp container is still starting and loading the model.

Note: The llama-cpp-server image (5.01 GB) was successfully pulled and cached. The timeout occurs during container startup and model loading, not during image pull.

## Logs

```text
Full onboarding log from fresh install:

[1/8] Preflight checks
Running bounded Docker GPU proof for NVIDIA RTX Spark N1X...
Docker GPU proof passed; trusting the reported GPU.
Docker GPU capacity proof: 60959 MiB available of 63936 MiB.
Docker daemon: server 29.7.2
Docker Desktop WSL detected; using Docker --gpus compatibility path instead of CDI spec validation.
Docker can start bridge containers
Host DNS resolution works
Docker container DNS resolution works
Container runtime: docker-desktop
Running under WSL
Container runtime resources: 16 vCPU / 54.8 GiB
openshell CLI: openshell 0.0.116
Port 8080 available (OpenShell gateway)
NVIDIA GPU detected (NVIDIA RTX Spark N1X (6144-core Blackwell RTX GPU), 63936 MB)
Sandbox GPU: enabled (auto)
Memory OK: 56118 MB RAM + 8192 MB swap

[2/8] Starting OpenShell gateway
Starting OpenShell gateway via managed service...
OpenShell gateway managed service is healthy

[3/8] Configuring inference provider
[non-interactive] Provider: install-llama-cpp
Verifying the exact llama.cpp GGUF in the shared Hugging Face cache
Still working on Provider selection... (30s elapsed)
Pulling pinned managed-inference image ghcr.io/nvidia/nemoclaw/llama-cpp-server@sha256:9d0cddd7bcaf98d3b75a7fc8c7ce3af3a9973b5f23a8092e7e93a9afc473a675
Managed llama.cpp install failed: Docker llama.cpp private loopback bridge probe failed (exit 28).
[non-interactive] Aborting: Docker llama.cpp private loopback bridge probe failed (exit 28).

Onboarding did not finish. Resume from the step that failed with:
nemoclaw onboard --resume
[ERROR] Onboarding did not complete successfully.

Related: PR #11444 (original namespace isolation bug fix confirmed working — exit 7 changed to exit 28)
```