ci(e2e): reuse exact-commit artifacts across retained live jobs

Parent: #7912

## Problem

Retained live E2E jobs repeatedly build or package identical NemoClaw CLI inputs and reconstruct versioned fixtures on fresh runners. This consumes runner-minutes without adding a distinct live boundary.

## Scope

- Build the NemoClaw CLI/package artifact once per workflow for the exact tested commit.
- Publish a content-addressed artifact with the commit SHA, artifact digest, toolchain identity, and provenance required by consumers.
- Require consuming jobs to verify the exact SHA and digest before use.
- Identify retained OpenClaw or gateway legacy/versioned fixtures that can be published immutably without bypassing the behavior under test.
- Keep one authoritative build/package contract rather than silently replacing all build validation.
- Measure runner-minute and wall-time impact on the retained jobs that consume the artifact.

## Ownership boundaries

- Do not duplicate Hermes rebuild fixtures or BuildKit-cache work in #7144.
- Do not duplicate larger-runner activation in #7145 or telemetry in #7146.
- Do not introduce the product-facing prebuilt onboarding interface tracked by #6402.
- If an assertion no longer needs a live boundary, route its relocation or retirement to #7614.

## Acceptance criteria

- [ ] The shared artifact is built from and cryptographically bound to the exact workflow commit.
- [ ] Consumers fail closed on missing, malformed, wrong-SHA, or digest-mismatched artifacts.
- [ ] At least one retained live job stops rebuilding the same CLI/package input.
- [ ] The authoritative build/package contract remains covered.
- [ ] Before/after wall time and runner-minutes are recorded.