[DGX Spark][Onboard] onboard --from accepts a Dockerfile path for OpenClaw but refuses the same path for Hermes and Deep Agents Code

## Description

`onboard --from {dockerfile}` accepts or refuses the same Dockerfile path depending
only on which agent is selected. With `--agent openclaw` the onboard proceeds and
builds the image; with `--agent hermes` or `--agent langchain-deepagents-code` the
same path is refused before any build with "Custom Dockerfile is inside an ignored
build-context path".

The two agents take different build paths for the same flag. OpenClaw reports
"Building sandbox image with BuildKit (skips the slower in-gateway builder)", so it
never reaches the ignored-build-context guard. Hermes and Deep Agents Code go through
the in-gateway builder, where the guard applies. Whichever side is correct, the
documented `--from` flag is not agent-neutral today, and a user who has a working
custom-image workflow on OpenClaw cannot move it to the other two agents.

This was hit while exercising a cross-sandbox snapshot restore case that needs a
non-managed-image Hermes or Deep Agents source sandbox: `snapshot restore --to` is
documented as unavailable for NemoClaw-managed images, and `--from` is the documented
way to create a non-managed one, so neither route is open for those two agents.

Platform scope: Reproduced on DGX Spark (Ubuntu 24.04, aarch64); the guard is in the
onboard path and is not expected to be hardware specific. Other
platforms not tested this pass.
Regression: Unknown - earlier builds not tested this pass.
OpenShell issue: No - the refusal is printed by NemoClaw's own onboard flow before any
gateway build is requested, and the OpenClaw run against the identical path succeeds
through the same gateway.

## Environment

```text
Device: NVIDIA DGX Spark
OS: Ubuntu 24.04.4 LTS
Architecture: aarch64
Kernel: 7.0.0-1010-nvidia
Node.js: v24.21.0
npm: 11.19.0
Docker: Docker version 29.2.1, build a5c7197
OpenShell CLI: openshell 0.0.116
NemoClaw: nemoclaw v0.0.125
```

## Steps to Reproduce

```bash
Run the same command three times, changing only --agent. Use any Dockerfile that
lives inside an installed package directory; the one shipped with the NemoClaw
package is a convenient example.

1. Record the path of a Dockerfile inside the installed package directory:
DF={npm global prefix}/lib/node_modules/nemoclaw/Dockerfile

2. nemoclaw onboard --fresh --from "$DF" --agent openclaw --name ctl-oc \
--non-interactive --yes

3. nemoclaw onboard --fresh --from "$DF" --agent hermes --name ctl-hm \
--non-interactive --yes

4. nemoclaw onboard --fresh --from "$DF" --agent langchain-deepagents-code \
--name ctl-da --non-interactive --yes

Use a different gateway port per run so the runs do not contend, and destroy each
sandbox between runs.
```

## Expected Result

`--from` behaves the same way for every agent. Either all three accept the path and
build, or all three refuse it with the same message. The flag's documented behaviour
should not depend on the selected agent.

## Actual Result

```text
Same path, same flags, only --agent differs:

agent exit outcome
openclaw 0 reaches image build, sandbox created
hermes 1 refused before any build
langchain-deepagents-code 1 refused before any build

OpenClaw, at step [6/8] Creating sandbox:

Creating sandbox 'ctl-oc' (this takes a few minutes on first run)...
Building sandbox image with BuildKit (skips the slower in-gateway builder)...

Hermes and Deep Agents Code, at the same step:

[6/8] Creating sandbox
Custom Dockerfile is inside an ignored build-context path:
{package directory}
Move your Dockerfile to a dedicated directory and retry.

Onboarding did not finish. Resume from the step that failed with:
nemoclaw onboard --resume

The refusal happens before any build is attempted, so no gateway work is involved.
Both refusing runs printed the identical message and exited 1; the OpenClaw run
against the identical path exited 0.
```

## Logs

```text
Three consecutive runs on one host, one after another, differing only in --agent:

########## agent=openclaw name=ctl-oc
RC=0
REFUSED_BUILD_CONTEXT=0
GOT_TO_BUILD=2
########## agent=hermes name=ctl-hm
RC=1
REFUSED_BUILD_CONTEXT=1
GOT_TO_BUILD=0
########## agent=langchain-deepagents-code name=ctl-da
RC=1
REFUSED_BUILD_CONTEXT=1
GOT_TO_BUILD=0

(REFUSED_BUILD_CONTEXT counts lines matching "ignored build-context path";
GOT_TO_BUILD counts lines matching "Building sandbox image".)
```

## Related Bugs / not duplicate of

Checked the open and closed NemoClaw issue list. Distinct from:

- **#7996** — `onboard --from` a custom Dockerfile produces a sandbox missing runtime
scripts so OpenClaw cannot start. There the build succeeds and the resulting sandbox
is broken; here two agents refuse the path outright and never build, while OpenClaw
builds successfully from the same path.
- **#10266** — portable onboard cannot build the sandbox image because the Dockerfile
uses `ADD --checksum` syntax Podman does not support. That is a build-engine syntax
failure reached during the build; this refusal happens before any build and is not
portable-specific.

Start with the onboard command and search for the exact "Custom Dockerfile is inside an ignored build-context path" message, then compare the OpenClaw BuildKit path with the Hermes and Deep Agents Code in-gateway path. Re-run the three commands from the reproduction steps and consider the work done when the same Dockerfile path has consistent behavior across all three agents.

Written by the indexing model from the issue text.