[Linux][CLI&UX] hermes runtime-config-guard blocks consecutive policy-remove and upgrade-sandboxes cannot resolve hermes sandbox version

> [!WARNING]
> **Regression**: worked in v0.0.90, broken in v0.0.91

## Description

Two related issues with the NemoHermes runtime config guard and CLI:

1. `policy-remove` is not idempotent on hermes sandboxes. The first `policy-remove` succeeds, but a second `policy-remove` on a different valid preset immediately after returns exit code 1. The hermes runtime-config-guard appears to hold a config lock or be mid-reload between consecutive policy mutations.

2. `upgrade-sandboxes --check` cannot resolve version metadata for hermes-gateway sandboxes. It reports "Unknown version: v?" and "sandbox not found on recorded gateway: hermes".

Platform scope: Reproduced on DGX Spark and macOS (hermes runners); openclaw runners not affected

## Environment

```text
Device: DGX Spark (arm64) / macOS (arm64)
OS: Linux (DGX Spark) / macOS (Darwin)
Architecture: arm64
Node.js: v22.22.3
npm: 10.9.8
Docker: Docker Engine 29.4.0
OpenShell CLI: openshell 0.0.85
NemoClaw: nemoclaw v0.0.91
OpenClaw: N/A (hermes agent)
```

## Steps to Reproduce

**Issue 1 (policy-remove):**
1. Install NemoClaw v0.0.91 with NemoHermes agent and onboard with multiple policy presets
2. Run: `nemoclaw policy-remove --yes` (succeeds)
3. Immediately run: `nemoclaw policy-remove --yes` (fails exit 1)

**Issue 2 (upgrade-sandboxes):**
1. Install NemoClaw v0.0.91 with NemoHermes agent
2. Create a cloned sandbox
3. Run: `nemoclaw upgrade-sandboxes --check`

## Expected Result

- Issue 1: Both `policy-remove` commands should succeed (exit 0).
- Issue 2: `upgrade-sandboxes --check` should resolve version for hermes sandboxes.

## Actual Result

Issue 1: Second `policy-remove` returns exit code 1 due to config-guard lock contention.

Issue 2:
```text
Unknown version: v? -> v0.18.0
1 recorded sandbox(es) were not found on their recorded gateway: hermes
```

## Logs

Not captured

---
[NVB#6503194](https://nvbugspro.nvidia.com/bug/6503194)

Reproduce both failures with NemoHermes: run consecutive `policy-remove` commands, then `upgrade-sandboxes --check`. Trace the `runtime-config-guard` reload or lock handling and the hermes-gateway version metadata lookup; done means both policy removals exit 0 and the upgrade check resolves the hermes sandbox version without the recorded-gateway error.

Written by the indexing model from the issue text.