[Ubuntu 24.04][CLI&UX] nemoclaw <sandbox> mcp add exits 0 on invalid input (plaintext HTTP / bad name / reserved env) — breaks $? scriptability

## Description

`nemoclaw mcp add` prints the correct rejection message for invalid input (plaintext HTTP url, invalid server name, reserved credential env name) but exits 0. A script or CI step that gates on `$?` treats the rejected add as success. The validation itself fails closed — nothing is registered — so this is purely an exit-code defect on a brand-new command surface.

This is the same exit-0-on-user-error class fixed for five other CLI surfaces via #5974; `mcp add` is a new command (managed MCP feature) not covered by that fix.

Platform scope: Reproduced on Ubuntu 24.04 (x86_64) only; the validation is enforced in the shared CLI command layer (documented agent-agnostic), so it is expected to reproduce identically on other platforms/agents, but only Ubuntu 24.04 x86_64 was exercised.

Regression: No — new functionality; `mcp add` shipped with exit 0 on invalid input.

## Environment

```text
Device: Ubuntu 24.04 server (A100 GPU)
OS: Ubuntu 24.04.4 LTS
Architecture: x86_64
Node.js: v22.23.1
npm: 10.9.8
Docker: 29.6.0
OpenShell CLI: 0.0.72
NemoClaw: v0.0.74
OpenClaw: N/A (langchain-deepagents-code sandbox; host-side CLI path)
```

## Steps to Reproduce

On a Ready sandbox (any agent; a DeepAgents sandbox named `dcode-sb` used here):

1. Plaintext HTTP url (HTTPS required):
```bash
export TESTTOK=dummy
nemoclaw dcode-sb mcp add badhttp --url http://example.com/mcp/ --env TESTTOK
echo "EXIT:$?"
```
2. Invalid server name (starts with a digit):
```bash
nemoclaw dcode-sb mcp add 1srv --url https://api.githubcopilot.com/mcp/ --env TESTTOK
echo "EXIT:$?"
```
3. Reserved credential env name:
```bash
nemoclaw dcode-sb mcp add rsvd --url https://api.githubcopilot.com/mcp/ --env PATH
echo "EXIT:$?"
```

## Expected Result

Each invalid `mcp add` is rejected with its message **and** exits non-zero (1), so `$?`-gated scripts/CI detect the rejection.

## Actual Result

Each is rejected with the correct message but exits 0:

```text
$ nemoclaw dcode-sb mcp add badhttp --url http://example.com/mcp/ --env TESTTOK
Authenticated MCP server URLs must use https:// so the configured MCP client uses TLS when OpenShell forwards credential-bearing requests.
EXIT:0

$ nemoclaw dcode-sb mcp add 1srv --url https://api.githubcopilot.com/mcp/ --env TESTTOK
Invalid MCP server name '1srv'. Names must start with a letter and contain only letters, digits, hyphens, and underscores.
EXIT:0

$ nemoclaw dcode-sb mcp add rsvd --url https://api.githubcopilot.com/mcp/ --env PATH
MCP credential environment name 'PATH' is reserved for host subprocess control and could be forwarded outside the provider mutation. Use a dedicated secret name such as MY_SERVICE_MCP_TOKEN.
EXIT:0
```

Fail-closed confirmation: `nemoclaw dcode-sb mcp list` reports "No MCP servers" — none of the three invalid adds registered a server; only the exit code is wrong.

## Logs

Not captured beyond the terminal output above.