Export a canonical managed Deep Agents sandbox with hosted inference

Parent: #10904. Implementation target: **main**.

## Problem and outcome

Main provisions immutable managed LangChain Deep Agents Code workloads, but its config schema and export verifier accept only OpenClaw and Hermes. Add one complete canonical Deep Agents export to unblock representative deployment comparison in #11810.

At `f5c05a0e6a59bd5133c50e31becbff25af274c33`, compare [supported schema agents](https://github.com/NVIDIA/NemoClaw/blob/f5c05a0e6a59bd5133c50e31becbff25af274c33/src/lib/config/model.ts) and [export projections](https://github.com/NVIDIA/NemoClaw/blob/f5c05a0e6a59bd5133c50e31becbff25af274c33/src/lib/domain/config/verify-export-source.ts) with the existing [managed startup builder](https://github.com/NVIDIA/NemoClaw/blob/f5c05a0e6a59bd5133c50e31becbff25af274c33/src/lib/onboard/managed-startup/profile-builder.ts).

## Before / after

### Before

A ready Linux/Docker sandbox named `dcode-demo` runs the stock immutable LangChain Deep Agents Code workload with supported hosted inference. Its retained profile explicitly records dashboard disabled, automatic approval disabled and observability disabled.

```bash
nemoclaw config export dcode-demo --output dcode-demo.yaml
```

Main refuses the source and exits nonzero without publishing YAML. The agent-type check reports `V1 export requires OpenClaw or Hermes.` This is the source-level behavior at the revision above, not a claim of a newly reproduced live failure.

### After

For the same supported sandbox and command, export exits zero and writes a complete, schema-valid `NemoClawConfig`. Its primary agent has the existing runtime identity:

```yaml
# spec.sandboxes[0].agents[0] — identity excerpt
name: primary
type: langchain-deepagents-code
```

The full document also contains the verified immutable sandbox image, managed gateway, hosted provider/API/endpoint, credential reference, selected model and inference route, and current effective policy. It must not relabel the agent as OpenClaw or Hermes or substitute guessed defaults for retained state.

For this first Deep Agents schema branch, omitted dashboard, approval and observability settings mean the disabled baseline described above. The exporter must establish those disabled values from the retained profile before omitting them. A source with enabled observability, thread opt-in approval, unsupported integrations, missing provenance or identity drift still exits nonzero without publishing a document.

The acceptance test compares the complete export with independent scenario expectations and confirms export leaves the running deployment unchanged. Producing this main-branch document does not yet make it directly importable by v1 `nemoclaw plan`.

## Scope

One Linux/Docker immutable managed Deep Agents sandbox, managed gateway, supported hosted OpenAI-completions inference, dashboard disabled, automatic approval disabled and observability disabled. Reuse the runtime's existing agent identity and canonical profile builder. Define omission semantics for this baseline so export cannot silently represent enabled settings as disabled.

## Acceptance

- Export agent identity, immutable image, provider/API/model, credential source reference and current effective policy through the existing action.
- Verify retained workload authority against sandbox/gateway/provider/route identities, including Deep Agents' existing upstream metadata contract.
- Establish the baseline from explicit retained profile values. Reject enabled observability, thread opt-in approval and other unrepresented settings with a bounded diagnostic and no document.
- Preserve OpenClaw/Hermes outputs and reject incomplete, drifted or unstable source evidence.
- An existing Deep Agents installed-CLI scenario produces schema-valid output with independently expected semantics and no fixture secrets.

Broader Deep Agents settings, MCP, other Fabric harnesses and local inference remain separate slices. v1 currently requires external services for its Deep Agents harness; this issue establishes main export coverage and does not claim identical ownership topology across branches.

## Delivery boundary

Extend the existing observation → verification → document builder → schema → publication pipeline. Export remains read-only and emits credential references only. Preserve successful existing exports and refusals for unrelated unsupported state. Regenerate the checked-in schema when its source changes.

Use a failing behavioral test before implementation, focused schema/action tests, and an existing installed-CLI scenario for the real boundary. Reuse coverage work in #11485; branch-to-branch translation and deployment parity remain with #11810. This issue does not add config-driven apply, resource adoption, or change existing onboarding inputs.

Compare supported agents in src/lib/config/model.ts and export projections in src/lib/domain/config/verify-export-source.ts with the managed startup builder at src/lib/onboard/managed-startup/profile-builder.ts. Start with a failing behavioral test, then trace the existing observation, verification, document-builder, schema, and publication pipeline. Done means the installed-CLI Deep Agents scenario produces independently validated YAML, rejects drifted or unsupported state without publishing, and preserves existing exports.

Written by the indexing model from the issue text.