feat(install): support portable air-gapped production deployment bundles

## Summary

Define and support an official NemoClaw production deployment workflow for restricted or fully air-gapped environments, including a portable install-bundle path where an operator can prepare a NemoClaw install on a connected machine, copy the required artifacts to removable media such as a USB drive, and install/run NemoClaw on an isolated target machine.

Parent: #2218

## Problem

Today operators who need to deploy NemoClaw in restricted production environments must build custom wrappers around install, image pull, dependency staging, credentials, registry access, and policy setup. This is risky and hard to support.

A concrete desired workflow is:

1. Prepare or download the required NemoClaw artifacts on a connected machine.
2. Copy the install bundle to a USB drive or similar removable media.
3. Move the bundle to an isolated target machine.
4. Install and run NemoClaw without requiring direct internet access.

## Proposed Scope

- Document the minimum production deployment prerequisites.
- Define the required offline artifacts: container images, npm/package dependencies, OpenShell/OpenClaw assets, model/provider prerequisites, and policy presets.
- Provide a supported workflow for staging those artifacts into an internal registry, local cache, or portable offline bundle.
- Make install/onboard failures in restricted networks actionable.
- Document how secrets and credentials should be handled in production without baking them into images.

## Non-goals

- Do not promise that every provider/model works offline.
- Do not replace site-specific DevOps automation.
- Do not weaken sandbox/network policy for convenience.

## Acceptance Criteria

- [ ] Docs describe a supported restricted-network deployment workflow.
- [ ] Docs describe a portable USB/offline-bundle install path.
- [ ] Required images/packages/artifacts are listed explicitly.
- [ ] Operators can pre-stage artifacts in an internal registry/cache or removable-media bundle.
- [ ] Install/onboard docs explain how to configure proxy, registry, and certificate requirements.
- [ ] Secrets are not embedded in images or offline bundles.
- [ ] Known unsupported offline/provider combinations are documented.