[macOS][Onboard] --resume recreates an unchanged custom-image sandbox and loses route ownership after scope warm-up

> [!WARNING]
> **Regression** — equivalent resume and route-reservation recovery behavior passed in v0.0.90; this custom-image path is broken in v0.0.125.

## Description

On macOS arm64 with NemoClaw v0.0.125, a valid custom-image OpenClaw sandbox is created successfully, but final scope warm-up leaves onboarding resumable. Running the recommended `onboard --resume` command incorrectly reports that unchanged messaging configuration changed, recreates the sandbox, and then aborts because the sandbox create route reservation is not owned by the resumed onboarding session.

The failure prevents supported custom-image sandboxes from reaching a completed onboarding state and blocks `snapshot restore --to` validation, which requires a custom-image source.

Platform scope: Reproduced on macOS arm64. Other platforms have not been tested with this exact custom-image scope-warm-up path.

Regression: Yes — equivalent resume and route-reservation recovery behavior was verified fixed on v0.0.90, but this distinct custom-image path reproduces on v0.0.125.

OpenShell issue: No — the failure is emitted by NemoClaw onboarding checkpoint and route-reservation ownership handling after the OpenShell sandbox was created successfully.

## Environment

```text
Device: CI Mac, Apple M4 Max
OS: macOS 26.5, Darwin 25.5.0
Architecture: arm64
Node.js: v22.23.2
npm: 10.9.8
Docker: client 29.5.2, daemon 29.2.1
OpenShell CLI: openshell 0.0.116
NemoClaw: v0.0.125
OpenClaw: 2026.7.1
```

## Steps to Reproduce

1. Install NemoClaw v0.0.125 on a clean macOS arm64 host and configure a valid supported hosted inference provider.
2. Create a Dockerfile that extends `ghcr.io/nvidia/nemoclaw/openclaw-sandbox:v0.0.125` and preserves the required managed runtime user and `NEMOCLAW_TOOL_DISCLOSURE` build arguments.
3. Run `nemoclaw onboard --non-interactive --no-gpu --from ./Dockerfile --name scope-resume-custom --agent openclaw`.
4. Wait for the sandbox image build, sandbox creation, and OpenClaw gateway launch to succeed.
5. Observe onboarding stop after the bounded CLI scope warm-up and recommend resume.
6. Run `nemoclaw onboard --non-interactive --resume --no-gpu --from ./Dockerfile --name scope-resume-custom --agent openclaw`.
7. Observe that resume treats unchanged messaging selection as changed, attempts to recreate the sandbox, and aborts with a route-reservation ownership error.

## Expected Result

The resumed onboarding run should reuse the completed custom-image sandbox and its existing route reservation, finish the bounded readiness work, and complete successfully. An unchanged no-channel messaging selection should not force sandbox recreation.

## Actual Result

The initial run creates the custom image and sandbox successfully, launches the OpenClaw gateway, then reports:

```text
OpenClaw onboarding for 'scope-resume-custom' is incomplete because the bounded CLI scope warm-up could not run. Resume or rerun onboarding.
```

The recommended resume run reports:

```text
[resume] Reusing messaging selection: no channels.
[resume] Messaging channel configuration changed; recreating sandbox.
Error: The sandbox create route reservation is not owned by this onboarding session
```

The resumed onboarding does not complete.

## Logs

```text
Using custom Dockerfile: ./Dockerfile
Sandbox image build completed
Sandbox 'scope-resume-custom' created
OpenClaw gateway launched inside sandbox
Still working on Verification at 30, 60, 90, and 120 seconds
OpenClaw onboarding for 'scope-resume-custom' is incomplete because the bounded CLI scope warm-up could not run. Resume or rerun onboarding.

On resume:
[resume] Skipping preflight (cached)
[resume] Skipping gateway (running)
[resume] Skipping provider_selection
[resume] Skipping inference
[resume] Reusing web search selection: disabled.
[resume] Reusing messaging selection: no channels.
[resume] Reusing OpenShell default resources.
[resume] Messaging channel configuration changed; recreating sandbox.
Error: The sandbox create route reservation is not owned by this onboarding session
```

Reproduce the failure with `nemoclaw onboard --non-interactive --resume --no-gpu --from ./Dockerfile --name scope-resume-custom --agent openclaw`, then trace onboarding checkpoint resume and sandbox create route-reservation ownership handling. Done means unchanged no-channel messaging reuses the custom-image sandbox and existing reservation, completes bounded readiness work, and no longer aborts.

Written by the indexing model from the issue text.