[Ubuntu 24.04 GPU][Hermes][Onboard] healthy sandbox aborts because OpenShell forward cleanup cannot be proven

## Description

On NemoClaw v0.0.126, clean Hermes onboarding on Ubuntu 24.04 GPU creates a Ready sandbox and starts a healthy Hermes gateway, but onboarding aborts while starting the host dashboard/API forward on port 8642. NemoClaw reports that it cannot prove OpenShell forward cleanup, so no workload test can begin.

The failure reproduced in two independent clean targeted runs after runner-owned residue was removed and preflight passed.

## Environment

- NemoClaw: v0.0.126
- Platform: Ubuntu 24.04 x86_64 with NVIDIA GPU
- Agent: Hermes
- Container runtime: Docker
- OpenShell gateway: healthy
- Sandbox: Ready
- Hermes gateway: healthy

## Steps to reproduce

1. Start from a clean Ubuntu 24.04 GPU host with Docker available.
2. Install NemoClaw v0.0.126.
3. Onboard a Hermes sandbox with a valid NVIDIA inference configuration.
4. Wait for sandbox creation and Hermes gateway health.
5. Observe dashboard/API forward finalization on host port 8642.

## Expected result

NemoClaw establishes or safely reconciles the owned host forward and onboarding completes.

## Actual result

```text
Failed to start dashboard forward on port 8642 for 'hermes': NemoClaw could not prove OpenShell forward cleanup. Inspect the listener before retrying onboarding.
```

The failure occurs after the sandbox is Ready and the Hermes gateway health check succeeds.

## Reproducibility

Reproduced in 2/2 clean targeted v0.0.126 runs on the dedicated Ubuntu 24 GPU runner. Harness cleanup and preflight completed successfully before each run.

## Duplicate check

No exact open issue was found. Related closed issues #4064 and #6099 concern earlier forward creation/list-tracking timeouts, not this current fail-closed cleanup-proof path.

---
[NVB#6789585](https://nvbugspro.nvidia.com/bug/6789585)

Start with the NemoClaw onboarding flow that finalizes the dashboard/API forward on host port 8642, and reproduce the failure on a clean Ubuntu 24.04 GPU host using Docker. Inspect how the owned host forward is reconciled and how OpenShell cleanup is proven after the sandbox and Hermes gateway become healthy. Done means onboarding safely establishes or reconciles the forward without aborting when cleanup can be verified.

Written by the indexing model from the issue text.