policy list mislabels DCode's auto-added observability preset as user-added

## Investigation Summary
- `classifyPresetProvenance()` (`src/lib/policy/preset-provenance.ts`) labels a live policy preset as `from agent` only when `context.agentName` is `openclaw` or `hermes`; every other agent name falls through to `{ source: "user" }`.
- The canonical agent-preset map, `setupPolicyPresetAppliesToAgent()` (`src/lib/onboard/agent-policy-presets.ts:14-23`), already covers three agents: it checks `HERMES_TOOL_GATEWAY_PRESET_NAMES`, `DCODE_ONLY_POLICY_PRESETS` (agent `langchain-deepagents-code`, aliased as `dcode`), and `OPENCLAW_ONLY_POLICY_PRESETS`.
- `DCODE_ONLY_POLICY_PRESETS` (`src/lib/onboard/observability-policy-presets.ts:9-11`) contains `observability-otlp-local`, auto-applied during onboarding for a DCode sandbox with observability enabled (`src/lib/onboard/policy-selection.ts:327`, `src/lib/onboard/sandbox-create/orchestration.ts:1724`).
- `classifyPresetProvenance()` never checks `DCODE_ONLY_POLICY_PRESETS`, so `policy list` on a DCode sandbox mislabels its own auto-added `observability-otlp-local` preset as `[user-added]`.

## Impact
**Impact: silent-wrong-result.** No crash, no error — the CLI prints a confident but incorrect provenance tag.
**Who hits this:** any operator running the documented `nemoclaw policy list ` command against a DCode (`langchain-deepagents-code`) sandbox that has observability enabled. The observed output mislabels NemoClaw's own auto-applied `observability-otlp-local` network preset as `[user-added]` instead of `[from dcode agent]`, understating what the tool itself configured and making an operator auditing the sandbox's network policy misattribute an agent-managed preset to themselves.

## Description
`policy list` on any DCode (`langchain-deepagents-code`) sandbox with observability enabled shows the agent-managed `observability-otlp-local` network preset tagged `[user-added]` instead of `[from dcode agent]`. Every other agent-managed preset (OpenClaw's `brave`/`openclaw-pricing`, Hermes's tool-gateway presets) is labeled correctly; only the DCode case is missing.

This is drift, not a decision: `preset-provenance.ts` was added in #5797 (2026-06-30), before DCode observability presets existed. DCode's `DCODE_ONLY_POLICY_PRESETS` was introduced a week later in #6340 (2026-07-07) and wired into every other agent-preset consumer (`agent-policy-presets.ts`, `policy-tier-suppression.ts`), but never into `preset-provenance.ts`. A later refactor, #10515 (2026-08-30), touched the surrounding policy-source code without adding the missing branch either.

## Reproduction Steps
1. Import `classifyPresetProvenance` from `src/lib/policy/preset-provenance.ts`.
2. Call `classifyPresetProvenance("observability-otlp-local", { agentName: "langchain-deepagents-code" })`.
3. Result is `{ source: "user" }` instead of `{ source: "agent", agent: "dcode" }`, even though `observability-otlp-local` is exactly the preset DCode onboarding auto-applies for that agent.
4. On a live DCode sandbox with observability enabled, `nemoclaw policy list ` prints the preset row with `[user-added]` instead of an agent-provenance tag, understating what NemoClaw itself put there.

## Environment
- OS: Ubuntu 24.04 LTS (x86_64)
- Node.js: v22.23.1
- Docker: not needed — reproduced via direct unit-level execution of `classifyPresetProvenance()`, no live sandbox required
- NemoClaw: reproduced against `main` at commit `a5889cd1288fd9ee225beafc7974b6390e164d32`

Start in src/lib/policy/preset-provenance.ts and compare classifyPresetProvenance() with the agent mappings in src/lib/onboard/agent-policy-presets.ts and DCODE_ONLY_POLICY_PRESETS in src/lib/onboard/observability-policy-presets.ts. Reproduce the direct classifyPresetProvenance("observability-otlp-local", { agentName: "langchain-deepagents-code" }) call. Done means the result identifies the preset as coming from the dcode agent rather than the user.

Written by the indexing model from the issue text.