Track removal of macOS final-destroy gateway cleanup workaround

Follow-up for #4662 after the immediate cleanup mitigation lands.

Remove the macOS-only unattended final-sandbox gateway cleanup default once OpenShell/Docker-driver destroy reliably releases the host gateway listener without NemoClaw forcing shared gateway teardown.

Removal conditions:
- A live macOS OpenShell/Docker-driver destroy of the final sandbox releases the configured gateway listener without `--cleanup-gateway` or the NemoClaw macOS default.
- A checked-in regression or release validation covers final unattended destroy leaving no stale listener on the gateway port.
- Linux gateway reuse semantics from #2166 remain preserved.

Until those conditions hold, unattended macOS final destroys must keep cleaning the shared gateway to avoid leaving port 8080/derived gateway ports occupied.

Start by reviewing #4662 and #2166, then run a live macOS OpenShell/Docker-driver destroy of the final sandbox and inspect whether the configured gateway listener is released without cleanup flags. Done means the macOS default workaround is removed only after a checked-in regression or release validation proves unattended final destroy leaves no stale gateway listener while Linux gateway reuse remains intact.

Written by the indexing model from the issue text.