[Linux][Sandbox] snapshot restore does not preserve gateway websocket credentials causing agent invocations to fail

> [!WARNING]
> **Regression**: worked in v0.0.90, broken in v0.0.91

## Description

When a sandbox is created via snapshot restore, the restored sandbox does not have valid gateway websocket credentials. Any subsequent `openclaw agent` invocation fails with `GatewayCredentialsRequiredError` because the gateway requires authentication before opening a websocket connection.

The snapshot captures the filesystem state but not the ephemeral gateway session tokens. A fresh onboard (the fallback path when snapshot fails) provisions new credentials, which is why some platforms pass.

Platform scope: Reproduced on Ubuntu 22.04 and Ubuntu 24.04 (openclaw); verified passing on DGX Station, Ubuntu 24.04 GPU, Ubuntu 26.04 GPU (these hit the fallback fresh-onboard path)

## Environment

```text
Device: Ubuntu 22.04 / Ubuntu 24.04 server
OS: Linux 5.15.0-173-generic / Linux 6.8.0
Architecture: x86_64
Node.js: v22.22.3
npm: 10.9.8
Docker: Docker Engine 29.4.0
OpenShell CLI: openshell 0.0.85
NemoClaw: nemoclaw v0.0.91
OpenClaw: unknown
```

## Steps to Reproduce

1. Install NemoClaw v0.0.91 and onboard with openclaw agent
2. Create a snapshot of the sandbox
3. Restore the snapshot into a new sandbox name
4. Run: `openclaw agent --agent main -m "say ok" --session-id test`
5. Observe GatewayCredentialsRequiredError

## Expected Result

The restored sandbox should have valid gateway credentials, or the restore process should re-provision them automatically.

## Actual Result

```text
GatewayCredentialsRequiredError: gateway agent requires credentials before opening a websocket.
Fix: configure gateway.auth token/password, pair this device, or pass --token/--password.
```

Agent exits with code 1.

## Logs

Not captured

---
[NVB#6503245](https://nvbugspro.nvidia.com/bug/6503245)

Start by reproducing the snapshot restore flow on Ubuntu with the listed openclaw agent command, then trace the restore path and the fresh-onboard credential provisioning path. Done means a restored sandbox can authenticate its gateway websocket and complete the agent invocation without GatewayCredentialsRequiredError.

Written by the indexing model from the issue text.