Install and remove supported service packages in NemoClaw v1

Parent: #10904

**Proposal: install, start, verify, and remove explicitly supported service packages through container runners and v1's existing plan/apply/destroy path.** Implementation requires a recorded `Accept` decision naming the accountable maintainer, initial integration, supported installer backend, and validation plan.

## Problem Statement

A service such as VoiceClaw needs to remain available after `nemoclaw apply` exits. Starting its server inside the apply process ties normal use to a provisioning command.

NemoClaw should install the selected package through a supported container runner, start it independently, verify startup, and return. It should retain enough ownership information to remove that installation later.

## Desired Behavior

### Plan

Inspect the current deployment and show the installation or removal changes needed. Reuse v1's existing SDK, configuration, and deployment state.

### Apply

For an explicitly supported package:

1. Validate the selected version, required settings, and supported backend.
2. Install the package and configure its declared connections.
3. Start it through the selected backend so it can remain running after the command exits.
4. Perform a bounded startup/readiness check.
5. Record the owned resources and return success or an actionable failure.

No NemoClaw monitor or reconciliation loop continues after apply. Normal client use does not require another apply.

A later, explicitly invoked plan/apply inspects the deployment again. An unchanged successful installation is a no-op. A retry of incomplete installation reuses verified owned resources and must not create duplicates.

### Destroy

Stop the owned instance as needed for removal, uninstall the package, and delete its owned installation resources. Revoke its managed connection access and verify removal before reporting success.

Do not uninstall the shared Docker/Podman engine or delete unrelated instances, shared artifacts, or external packages. Package-owned disposable files and credentials are removed. Persistent user/model data follows the existing or explicitly agreed retention contract; this proposal does not introduce blanket data deletion.

## Scope and Exclusions

Included:

- Installation, initial startup, bounded readiness verification, and removal for named supported packages.
- Container runners, such as Docker or Podman, qualified for each supported package.
- Named service definitions shared by inference providers and integrations through explicit references.
- Resource ownership and enough retained state to retry incomplete operations and remove owned resources.
- The existing shared SDK execution path used by the CLI and OpenTofu provider.

Excluded:

- Ongoing NemoClaw supervision, health monitoring, automatic restart, or background reconciliation.
- New service start/stop/restart/status/logs command families.
- Generic `lifecycle`, `desiredState`, or restart-policy YAML fields.
- Arbitrary packages, user-defined installer scripts, or a universal service/plugin framework.
- Systemd units, other host service managers, host process launchers, and OS package installation.
- A portable process supervisor or a requirement to support every operating system and container runner.
- A new upgrade, rollback, or runtime recovery framework.

Backend and application behavior after startup remain outside this installation feature. Existing inference supervision and safety behavior are outside this change.

## Candidate Packages and Services

These candidates come from the VoiceClaw proposal and verified NemoClaw implementations. Each candidate stays within **install → start → verify → exit**, followed by removal through destroy. Listing a candidate does not approve a new integration, backend, or migration. Managed installation in this feature requires a qualified container package; native v0 processes are evidence of a use case, not an included installation method.

| Candidate | Existing basis | Installation and removal boundary |
|---|---|---|
| **VoiceClaw** | Proposed integration in #11746 / #11822. | Install the agreed package, configure the selected agent connection, start and verify it, then exit. Destroy removes the owned installation and access. |
| **Ollama** | v0 [starts the local server](https://github.com/NVIDIA/NemoClaw/blob/2fd6903328a66de8256f4b5b300c2ec639e1fa01/src/lib/onboard/ollama-startup.ts#L97); v1 has a [managed container configuration](https://github.com/NVIDIA/NemoClaw/blob/32c3e9648696d0780f0aec74ef8bcce2e1d1d745/examples/managed-ollama.yaml). | Install and verify an owned instance. Remove only that installation; preserve externally installed daemons and existing model-data retention. |
| **vLLM** | v0 has [managed startup and readiness checks](https://github.com/NVIDIA/NemoClaw/blob/2fd6903328a66de8256f4b5b300c2ec639e1fa01/src/lib/inference/vllm.ts#L2259); v1 has a [typed service configuration](https://github.com/NVIDIA/NemoClaw/blob/32c3e9648696d0780f0aec74ef8bcce2e1d1d745/examples/vllm.yaml). | Provision the selected image/model, start and verify the owned serving instance, and remove owned installation resources. Keep existing model retention and runtime safety behavior. |
| **Ollama authentication proxy** | v0 [starts a separate proxy](https://github.com/NVIDIA/NemoClaw/blob/2fd6903328a66de8256f4b5b300c2ec639e1fa01/src/lib/inference/ollama/proxy.ts#L406); v1 has an [explicit proxy configuration](https://github.com/NVIDIA/NemoClaw/blob/32c3e9648696d0780f0aec74ef8bcce2e1d1d745/crates/nemoclaw-sdk/src/config/ollama_proxy.rs). | Install, configure, start, and verify the owned proxy. Remove the proxy and disposable owned credentials while leaving the external Ollama daemon and model alone. |
| **cloudflared** | v0 [starts a detached tunnel process](https://github.com/NVIDIA/NemoClaw/blob/2fd6903328a66de8256f4b5b300c2ec639e1fa01/src/lib/tunnel/services.ts#L323) and supports [tunnel-only stop](https://github.com/NVIDIA/NemoClaw/blob/2fd6903328a66de8256f4b5b300c2ec639e1fa01/src/lib/tunnel/services.ts#L630). | A possible later container target: start and verify the selected tunnel container, then remove its owned installation/configuration. Preserve unrelated tunnels. Native process and systemd installation are excluded. |
| **OpenShell gateway** | v0 has [managed gateway startup](https://github.com/NVIDIA/NemoClaw/blob/2fd6903328a66de8256f4b5b300c2ec639e1fa01/src/lib/onboard/gateway/start.ts#L65) and [explicit external ownership](https://github.com/NVIDIA/NemoClaw/blob/2fd6903328a66de8256f4b5b300c2ec639e1fa01/src/lib/onboard/gateway-management.ts#L43). | Use the existing managed gateway installation as a reference. An externally owned gateway stays outside installation/removal authority. |
| **Local NVIDIA NIM (experimental)** | v0 exposes an [experimental inference choice](https://github.com/NVIDIA/NemoClaw/blob/2fd6903328a66de8256f4b5b300c2ec639e1fa01/src/lib/onboard/provider-menu.ts#L95) and [pulls, starts, and checks its container](https://github.com/NVIDIA/NemoClaw/blob/2fd6903328a66de8256f4b5b300c2ec639e1fa01/src/lib/onboard.ts#L1815). | Consider only after separate selection and qualification. Install and remove the owned serving container under its model/data contract; retain its experimental status. |

Start with VoiceClaw's concrete installation need. Reuse existing installation patterns where they fit; this list does not require a common service framework or ongoing NemoClaw supervision.

## Initial Consumer and Related Work

VoiceClaw is the concrete proposed consumer from #11746 / #11822. Its package owner must supply an agreed artifact, startup settings, readiness check, and removal expectations. The first implementation should target that bounded package/backend combination after its integration decision is recorded.

Existing v1 [Ollama](https://github.com/NVIDIA/NemoClaw/blob/32c3e9648696d0780f0aec74ef8bcce2e1d1d745/examples/managed-ollama.yaml), [vLLM](https://github.com/NVIDIA/NemoClaw/blob/32c3e9648696d0780f0aec74ef8bcce2e1d1d745/examples/vllm.yaml), and [Ollama proxy](https://github.com/NVIDIA/NemoClaw/blob/32c3e9648696d0780f0aec74ef8bcce2e1d1d745/crates/nemoclaw-sdk/src/config/ollama_proxy.rs) configurations provide existing patterns. This issue does not require migrating them into a new abstraction.

#11453 remains separate: it covers configuration export for externally owned components, not their installation.

## Ongoing Ownership

NemoClaw maintainers own the installation code and its SDK/CLI/provider behavior. Each package owner defines its package-specific startup, readiness, compatibility, and cleanup requirements. The acceptance decision must name an accountable maintainer and the first supported backend.

## Placement and Support Expectations

Use the existing v1 SDK with proposed deployment-level service definitions in `spec.services`. Inference providers and application integrations select a named service through `serviceRef`. Keep each package's typed installation settings with its service definition.

Agents retain inference `providerRef` and application `integrationRefs`, following [the integration review](https://github.com/NVIDIA/NemoClaw/pull/11822#issuecomment-5691583792). Only references from selected providers or attached integrations activate a service. Unused definitions install nothing and grant no access. Multiple supported consumers of one service name share one installation, with separately authorized connections.

Share container installation helpers where the selected packages have a demonstrated common need. Keep the service kinds limited to explicitly supported packages; this is not an arbitrary container or plugin framework.

This remains a draft proposal. Acceptance of #10904 does not automatically approve a new package integration or backend.

## Validation Plan

- [ ] Apply installs and starts the selected package, verifies readiness within a bounded time, and exits.
- [ ] An independent client can use the service after apply exits, without a NemoClaw provisioning process remaining alive.
- [ ] Unchanged plan/apply preserves the existing instance and makes no unnecessary changes.
- [ ] Failed startup reports failure and preserves the healthy agent; an explicit retry does not duplicate owned resources.
- [ ] No NemoClaw background monitor or automatic restart mechanism is introduced.
- [ ] Managed installation uses the qualified container runner without creating systemd units or invoking a host service manager.
- [ ] Missing or incompatible service references fail validation; unused definitions create no resources or grants.
- [ ] Multiple supported consumers of one service name reuse one installation without granting access to unrelated agents.
- [ ] Destroy removes the owned installation and managed access, while preserving external resources and honoring the data-retention contract.
- [ ] Failed or interrupted removal remains visible and can be retried without deleting unrelated resources.
- [ ] CLI and provider use the same SDK operations; export/reapply preserves the supported configuration and ownership semantics.

Use focused ownership and failure tests plus one live check for the selected package/backend. Do not create a new cross-platform qualification matrix for this issue.

## Compatibility Requirements

Preserve typed package requirements, resource identities, ownership, and retention behavior when moving configuration to named services. Define conversion or explicit rejection for older schema and state; do not silently adopt or duplicate installations. Define the first package version, container runner, and supported platform before implementation. Other packages or backends need their own concrete requirements and validation.

YAML examples belong in the separate configuration comment. Proposed package fields must be marked as unsupported until implemented.

## Security or Privacy Impact

Verify ownership before removal. Keep credential values out of YAML, arguments, logs, exports, and provider state. Use existing protected credential storage with access limited to the required owner and runtime. Credentials needed by the installed service must remain usable after apply exits; destroy revokes managed access and removes disposable owned credentials.

Preserve existing agent and OpenShell credential boundaries. This issue does not define a new agent-access protocol or credential service.

## Implementation Idea

Add only the missing package-specific installation and removal operations through existing SDK/backend primitives. Keep startup and readiness checks with that package's implementation. Reuse the current deployment records and operation locks.

## Category

Feature

## Checklist

- [x] Identified the concrete VoiceClaw consumer and related inference installation patterns.
- [x] Limited the proposal to explicit provisioning and removal operations.
- [ ] Record an Accept decision, accountable maintainer, package contract, backend/platform boundary, and validation plan before implementation.

Start with parent issue #10904 and the existing v1 SDK plan/apply/destroy path, then read examples/managed-ollama.yaml, examples/vllm.yaml, and crates/nemoclaw-sdk/src/config/ollama_proxy.rs. Use VoiceClaw as the first concrete package only after its acceptance decision names the backend and maintainer. Done requires bounded install, readiness verification, ownership-aware retry and destroy behavior, shared CLI/provider SDK operations, and focused failure tests.

Written by the indexing model from the issue text.