[Linux][CLI&UX] dashboard-url is refused for an experimental Hermes portable sandbox although the CLI advertises it and onboarding prints the URL

## Description

`nemohermes {sandbox} dashboard-url` is refused on an experimental Hermes portable sandbox, even though the CLI advertises the command and onboarding has just verified and printed that sandbox's dashboard URL.

Onboarding for a portable Hermes sandbox completes successfully, reports "Deployment verified - gateway, dashboard, and inference route are healthy", and prints the dashboard URL together with the host port that must be forwarded to reach it. The command whose entire purpose is to retrieve that URL then exits 1 with "This command is not supported for an experimental Hermes portable sandbox."

So the dashboard exists, is healthy, is reachable on the printed port, and is advertised to the operator — but the supported way to obtain its URL is refused. The only way to recover the URL afterwards is to scroll back through the onboarding transcript, which is not available in a fresh shell or to any script.

`nemohermes --help` lists the command with no portable-profile exclusion:

```text
nemohermes {sandbox} dashboard-url Print the dashboard URL [--quiet|-q]
```

- **Platform scope:** Reproduced on Ubuntu 25.04 x86_64 only; other platforms not tested this pass.
- **Regression:** Unknown — earlier builds not tested this pass.
- **OpenShell issue:** No — the refusal comes from NemoClaw's own command dispatch, before any gateway call; the gateway and the sandbox are healthy throughout.

## Environment

```text
Device: x86_64 server with NVIDIA A100-SXM4-40GB
OS: Ubuntu 25.04
Architecture: x86_64
Podman: 5.7.0 (client and server)
OpenShell CLI: openshell 0.0.116
NemoHermes: nemohermes v0.0.126
Agent: Hermes, experimental portable profile
Provider: ollama-local, model qwen3:8b
```

## Steps to Reproduce

1. On a GPU host with rootless Podman at the exact version the portable profile requires, onboard a portable Hermes sandbox on an unused gateway port, and confirm it exits 0 and reports the deployment verified:

```bash
nemohermes onboard --experimental-profile portable --fresh --name {sandbox} \
--non-interactive --yes --yes-i-accept-third-party-software
```

2. Note the dashboard URL and port printed at the end of onboarding.
3. Confirm the CLI advertises the command:

```bash
nemohermes --help
```

4. Ask for the dashboard URL the documented way:

```bash
nemohermes {sandbox} dashboard-url --quiet
echo "EXIT=$?"
```

5. Confirm the dashboard forward is actually present on the host:

```bash
ss -ltn
```

## Expected Result

`dashboard-url` prints the same dashboard URL that onboarding printed, and exits 0.

If the portable profile genuinely cannot support this command, the CLI help should not advertise it for portable sandboxes, and onboarding should not present a dashboard URL that no supported command can return afterwards.

## Actual Result

Onboarding succeeds and advertises the dashboard:

```text
[8/8] Policy presets
Deployment verified - gateway, dashboard, and inference route are healthy.
Hermes Agent Dashboard
Port 18789 must be forwarded before opening this URL.
http://127.0.0.1:18789/
```

The dashboard forward is present on the host:

```text
LISTEN 0 128 127.0.0.1:18789 0.0.0.0:*
```

The command that returns that URL is refused:

```text
$ nemohermes {sandbox} dashboard-url --quiet
Error: This command is not supported for an experimental Hermes portable sandbox.
Command: sandbox:dashboard-url
EXIT=1
```

The same refusal appears without `--quiet`, and through the `nemoclaw` entry point for the same sandbox. Meanwhile the CLI help still lists it unconditionally:

```text
nemohermes {sandbox} dashboard-url Print the dashboard URL [--quiet|-q]
```

## Logs

```text
onboard exit 0, 8 of 8 stages completed
status Saved Portable lifecycle phase: active
dashboard-url --quiet exit 1, "not supported for an experimental
Hermes portable sandbox"
dashboard-url (no flag) same refusal
ss -ltn 127.0.0.1:18789 LISTEN present
```

## Related issues / not duplicate of

No existing report covers `dashboard-url` being refused for the portable profile.

Closest match, and not a duplicate: #5728 — `dashboard-url` prints a misleading error for a terminal-runtime Deep Agents Code sandbox. That sandbox has no dashboard at all, so refusing is correct there and only the wording was wrong. Here the dashboard exists, onboarding verifies it, prints its URL, and the host forward is listening — yet the command that returns that URL is refused outright.

Also distinct from reports about portable onboarding failing: here onboarding succeeds and the sandbox is healthy; only the URL-retrieval command is refused.

Start at NemoClaw’s CLI dispatch for the `sandbox:dashboard-url` command and trace how the experimental Hermes portable profile is handled; compare that path with onboarding’s dashboard URL output. Reproduce with the provided `nemohermes onboard` and `dashboard-url --quiet` commands, then verify that the command prints the onboarding URL and exits 0 for a healthy portable sandbox.

Written by the indexing model from the issue text.