[Ubuntu 24.04][Onboard] valid corporate CA makes managed image catalog validation fail

## Description

Deep Agents Code onboarding stops before sandbox creation when a valid explicit corporate CA bundle is enabled. The same environment completes onboarding when corporate CA import is disabled.

Platform scope: Reproduced on Ubuntu 24.04 only; other platforms not tested.

OpenShell issue: No.

## Environment

```text
Device: Ubuntu 24.04 x86_64 server, CPU-only Docker host
OS: Ubuntu 24.04, Linux 6.8.0-111-generic
Architecture: x86_64
Node.js: v22.23.2
npm: 10.9.8
Docker: Docker version 29.4.3, build 055a478
OpenShell CLI: openshell 0.0.116
NemoClaw: nemoclaw v0.0.126
OpenClaw: N/A (onboard not completed)
```

## Steps to Reproduce

1. Install NemoClaw v0.0.126 on a clean Ubuntu 24.04 x86_64 Docker host.
2. Configure a supported non-interactive inference provider with valid credentials.
3. Create a valid test CA bundle:

```bash
openssl req -x509 -newkey rsa:2048 -keyout /tmp/corp-ca.key -out /tmp/corp-ca.pem -days 1 -nodes -subj '/CN=CorporateCATest' -addext 'basicConstraints=critical,CA:TRUE'
```

4. Enable explicit corporate CA import:

```bash
export NEMOCLAW_CORPORATE_CA_BUNDLE=/tmp/corp-ca.pem
unset NEMOCLAW_CORPORATE_CA_IMPORT
```

5. Run Deep Agents Code onboarding:

```bash
nemoclaw onboard --non-interactive --fresh --no-gpu --agent langchain-deepagents-code --name dcode-ca-test --yes --yes-i-accept-third-party-software
```

6. Observe that onboarding exits with status 1 during sandbox creation.
7. As a control on the same clean environment, set `NEMOCLAW_CORPORATE_CA_IMPORT=0` and repeat step 5 with a new sandbox name.
8. Observe that the control onboarding completes and the Deep Agents Code runtime becomes ready.

## Expected Result

The valid explicit corporate CA is accepted and Deep Agents Code onboarding completes. Corporate CA import must not make the selected release's managed image catalog fail validation. This follows the published [Corporate CA Trust](https://docs.nvidia.com/nemoclaw/user-guide/deepagents/security/configure-corporate-ca-trust) flow.

## Actual Result

With corporate CA import enabled, onboarding exits with status 1 before sandbox creation:

```text
Error: Sandbox workload preparation failed: managed image catalog 'v0.0.126' failed validation
```

The same failure was observed on three CA-enabled onboarding attempts. With `NEMOCLAW_CORPORATE_CA_IMPORT=0` in the same environment, onboarding completed and the Deep Agents Code runtime became ready.

## Logs

```text
[6/8] Creating sandbox
Error: Sandbox workload preparation failed: managed image catalog 'v0.0.126' failed validation

Onboarding did not finish. Resume from the step that failed with:
nemoclaw onboard --resume
Completed steps are skipped; pass --fresh instead to start over.

Control run with corporate CA import disabled:
Creating sandbox 'dcode-ca-control'...
Sandbox 'dcode-ca-control' created
LangChain Deep Agents Code terminal runtime is ready
```

Start with the `nemoclaw onboard --non-interactive` entry point and reproduce the failure using the documented corporate CA environment variables. Trace the sandbox-creation path into managed image catalog validation, comparing CA-enabled and `NEMOCLAW_CORPORATE_CA_IMPORT=0` runs. Done means the valid explicit CA no longer causes catalog validation to fail and Deep Agents Code onboarding completes.

Written by the indexing model from the issue text.