rebuild/upgrade: atomic build-verify-swap before deleting old sandbox (health-before-delete)

### Problem

`nemoclaw rebuild` and the installer's `upgrade-sandboxes --auto` recreate a sandbox with the **same name** via `onboard --resume`: backup → `openshell sandbox delete` → recreate. PR #5787 (fixes #5735) validates every *determinable* recreate precondition before the delete (credential availability, provider/model/credential/endpoint resolution + custom-endpoint determinability, agent base image build) and makes failures fatal with a preserved state backup + recovery steps.

But a literal "build the replacement and verify it healthy **before** destroying the old container/image" is not achievable today: OpenShell recreates under the same sandbox name, so the old and new sandbox cannot run side by side. A residual transient runtime fault inside `onboard` after all preconditions pass can still leave the old sandbox destroyed with only backup-based recovery (the non-atomicity also tracked in #2273).

### Ask

Provide an OpenShell capability (or NemoClaw orchestration) to build and health-check a replacement sandbox under a temporary name and atomically swap it in before deleting the old one — enabling true health-before-delete for the auto-rebuild/upgrade path.

### Removal condition

When this lands, the pre-delete "validate determinable preconditions + backup recovery" mitigation in `src/lib/actions/sandbox/rebuild.ts` / `rebuild-resume-config.ts` can be replaced by the atomic build-verify-swap flow.

Context: PR https://github.com/NVIDIA/NemoClaw/pull/5787, issue #5735, related #2273.