[DGX Spark][Express Install] managed vLLM is reported unauthenticated but its OpenAI endpoint returns HTTP 401

## Description

On NemoClaw v0.0.124, the DGX Spark express-install path completes successfully and reports that the managed vLLM provider is ready at the local OpenAI-compatible endpoint. The completion summary explicitly says that an API key is not required for `vllm-local`. Immediately querying the advertised `/v1/models` endpoint returns HTTP 401 Unauthorized.

Platform scope: Reproduced on DGX Spark Linux aarch64. Other platforms were not evaluated for this managed-vLLM express profile.

Related: #8539 covered an earlier installer failure while verifying managed-vLLM authorization. This report is distinct: installation succeeds, but the advertised no-auth contract does not match the running endpoint.

## Environment

```text
Platform: DGX Spark
OS: Linux aarch64
NemoClaw: v0.0.124
OpenShell: v0.0.116
Agent: NemoHermes
Install mode: express
Provider: managed vLLM
```

## Steps to Reproduce

1. Run the supported express install on a DGX Spark with the managed-vLLM profile.
2. Wait for onboarding to complete and for the product to report the local vLLM endpoint ready.
3. Query the advertised local `/v1/models` endpoint without credentials, as instructed by the completion summary.

## Expected Result

The advertised local endpoint is usable without an API key, or the product accurately reports and supplies the required authentication contract.

## Actual Result

Express install exits successfully and reports that `vllm-local` does not require authentication, but `/v1/models` returns HTTP 401 Unauthorized.

## Impact

A successful express-install result cannot be used for inference through the advertised endpoint, and automated acceptance cannot complete.

## Logs

```text
Express installation completed successfully.
Provider: managed vLLM
The completion summary reports that vllm-local does not require authentication.
GET /v1/models: HTTP 401 Unauthorized
```

Start by locating the express-install completion summary and the managed-vLLM provider authentication configuration, then reproduce the documented GET request to the local /v1/models endpoint on DGX Spark. Done means the advertised no-auth contract matches the endpoint, or the summary accurately reports and supplies the required authentication so automated acceptance can complete.

Written by the indexing model from the issue text.