NemoClaw onboard --from custom Dockerfile sandbox missing runtime scripts; OpenClaw cannot start

## Description

When using `nemoclaw onboard --from` with a custom Dockerfile, the resulting sandbox image is missing NemoClaw Python runtime scripts that are required for OpenClaw to start. The custom sandbox builds and starts successfully, and any custom Docker layers are applied, but `/usr/local/lib/nemoclaw/` contains only 3 files versus 10+ in a standard sandbox. OpenClaw cannot start because `normalize_mutable_config_perms.py` and other required scripts are absent.

Platform scope: Reproduced on Ubuntu 24.04 x86_64 only; other platforms not tested.
Regression: Unknown — earlier versions not tested.

## Environment

```text
Device: Ubuntu 24.04 server (NVIDIA A100-SXM4-40GB)
OS: Ubuntu 24.04.4 LTS
Architecture: x86_64
Node.js: v22.16.0
npm: 10.9.2
Docker: Docker version 29.5.2, build 79eb04c
OpenShell CLI: openshell 0.0.85
NemoClaw: v0.0.98
OpenClaw: 2026.7.1 (2d2ddc4)
```

## Steps to Reproduce

1. Create a custom Dockerfile:

```bash
FROM ghcr.io/nvidia/nemoclaw/sandbox-base:latest
ARG NEMOCLAW_TOOL_DISCLOSURE=progressive
ENV NEMOCLAW_TOOL_DISCLOSURE=${NEMOCLAW_TOOL_DISCLOSURE}
RUN echo "custom-layer" > /usr/local/share/custom-marker.txt
```

2. Run onboard with the custom Dockerfile:

```bash
NEMOCLAW_GATEWAY_PORT=8090 nemoclaw onboard \
--non-interactive --yes \
--name custom-test \
--from /path/to/Dockerfile \
--fresh
```

3. After sandbox creation succeeds, inspect the runtime scripts directory:

```bash
nemoclaw custom-test exec -- ls /usr/local/lib/nemoclaw/
```

4. Check sandbox status:

```bash
nemoclaw custom-test status
```

## Expected Result

The custom sandbox image contains all NemoClaw runtime scripts, identical to a standard sandbox. OpenClaw starts successfully and `nemoclaw custom-test status` shows `OpenClaw: running`.

Standard sandbox `/usr/local/lib/nemoclaw/` contains:
- `clean_runtime_shell_env_shim.py`, `extract-semver`, `gateway-supervisor.sh`
- `managed-gateway-control.py`, `mcp-tool-discovery-runtime/`, `mcporter-runtime/`
- `normalize_mutable_config_perms.py`, `openclaw-config-guard.py`, `openclaw-runtime/`
- `patch-openclaw-tool-catalog.mts`, `sandbox-init.sh`, `sandbox-rlimits.sh`, `state-dir-guard.py`

## Actual Result

Custom sandbox `/usr/local/lib/nemoclaw/` contains only 3 entries:
```text
mcporter-runtime/
openclaw-runtime/
sandbox-rlimits.sh
```

Missing: `normalize_mutable_config_perms.py`, `clean_runtime_shell_env_shim.py`, `state-dir-guard.py`, `openclaw-config-guard.py`, `gateway-supervisor.sh`, `managed-gateway-control.py`, and others.

`nemoclaw custom-test status` reports:
```text
Phase: Ready
OpenClaw: not running
```

Error observed when exec-ing into sandbox:
```text
/usr/bin/python3: cannot open /usr/local/lib/nemoclaw/normalize_mutable_config_perms.py: [Errno 2] No such file or directory
```

Root cause identified in source: `src/lib/onboard/dockerfile-patch.ts` does not inject the Python runtime scripts (explicitly COPY'd in lines 92-99 of the standard Dockerfile) when patching a custom `--from` Dockerfile.

## Logs

Not captured — failure is observable via:
```bash
nemoclaw custom-test exec -- ls /usr/local/lib/nemoclaw/
nemoclaw custom-test status
```