[Linux][Onboard] nemoclaw onboard silently degrades to best_effort Landlock mode on kernel < 5.13 instead of aborting — sandbox created with reduced isolation

## Description

On a Linux host with kernel older than 5.13 (Landlock not supported), `nemoclaw onboard --agent langchain-deepagents-code` only prints a `⚠ Warning` and continues to create the sandbox with `best_effort` (no Landlock) isolation. The wizard does not abort, returns EXIT:0, and the sandbox appears as Ready. Users receive a sandbox without the documented filesystem isolation guarantees without any hard blocker.

## Environment

```text
Device: QEMU VM (Ubuntu 20.04 guest)
OS: Ubuntu 20.04.6 LTS
Architecture: x86_64
Kernel: 5.4.0-216-generic (Landlock requires >= 5.13)
Docker: 26.1.3
NemoClaw: v0.0.67
OpenClaw: deepagents-code 0.1.12
```

## Steps to Reproduce

```bash
# On a host with kernel < 5.13 (e.g. Ubuntu 20.04):
uname -r # 5.4.x

nemoclaw onboard --agent langchain-deepagents-code --name dcode-landlock-fail --non-interactive
echo "EXIT:$?"
nemoclaw list | grep dcode-landlock-fail
```

## Expected Result

Wizard detects unsupported kernel and aborts:
```
ERROR: Landlock filesystem isolation requires kernel >= 5.13.
Current kernel 5.4.0 does not support Landlock.
Sandbox cannot be created without documented isolation guarantees.
```
- `EXIT` non-zero
- `dcode-landlock-fail` does NOT appear in `nemoclaw list` as Ready

## Actual Result

Wizard prints a warning and continues to completion:
```text
⚠ Landlock: Kernel 5.4.0-216-generic does not support Landlock (requires ≥5.13).
Sandbox filesystem restrictions will silently degrade (best_effort mode).
[7/8] Setting up LangChain Deep Agents Code inside sandbox
[8/8] Policy presets
✓ LangChain Deep Agents Code terminal runtime is ready
Connect: nemoclaw dcode-landlock-fail connect

EXIT:0
```

`dcode-landlock-fail` is listed as Ready — user silently has a sandbox without Landlock isolation.

---
[NVB#6375586](https://nvbugspro.nvidia.com/bug/6375586)