[Brev][Onboard] onboard web UI shows a red error card with RETRY for a sandbox image build step that succeeded

## Description

The NemoClaw onboarding web UI served by `nemoclaw-onboard-ui.service` on a Brev launchable renders a red error card with a **RETRY** button under the "Create sandbox" step, quoting sandbox image build step `#19 [stage-1 9/34] RUN ... /usr/local/bin/dcode --version`.

That build step actually succeeds. The image build runs to completion and onboarding finishes all 8 phases: the sandbox reaches `Phase: Ready` and `dcode` answers prompts normally. The UI never retracts or supersedes the error card, so the operator is shown a failure for a successful onboarding and is invited to click RETRY, which re-runs `brev-quickstart` and rebuilds the entire sandbox for no reason.

Reproduced with agent LangChain Deep Agents Code (`dcode`) on the NVIDIA Cloud (build) provider.

- **Platform scope:** Reproduced on Brev launchable (Ubuntu 22.04) only; other platforms not tested
- **Regression:** Unknown — earlier versions not tested

## Environment

```text
Device: Brev launchable instance (n2d-standard-4, CPU-only, no GPU)
OS: Ubuntu 22.04.5 LTS (Linux 6.8.0-1064-gcp)
Architecture: x86_64
Node.js: v22.23.2
npm: 10.9.8
Docker: Docker version 29.1.3, build 29.1.3-0ubuntu3~22.04.2
OpenShell CLI: openshell 0.0.85
NemoClaw: nemoclaw v0.0.97
OpenClaw: N/A - agent is LangChain Deep Agents Code v0.1.34 (deepagents SDK 0.7.0a6)
```

## Steps to Reproduce

1. Create a Brev instance from the NemoClaw launchable and open the onboarding web UI (port 3000) in a browser.
2. Select agent **LangChain Deep Agents Code**, provider **NVIDIA Cloud (build)**, model `nvidia/nemotron-3-ultra-550b-a55b`, sandbox name `deepagents-code`.
3. Start onboarding and watch the "Create sandbox" step and the Activity Log.
4. When the image build reaches `#19 [stage-1 9/34] RUN ... dcode --version`, observe the step status in the UI.
5. Let onboarding run to completion, then on the host run:

```bash
nemoclaw list
nemoclaw deepagents-code status
nemoclaw deepagents-code connect # then run: dcode
```

## Expected Result

BuildKit progress lines are rendered as build progress. The UI reports an error only when a build step actually fails (BuildKit prints its own `ERROR: process "..." did not complete successfully`) or when `brev-quickstart` exits non-zero. A step that reports `DONE` is shown as complete, and a successful onboarding ends in the success state with no RETRY offered.

## Actual Result

A red error card with a RETRY button appears under "Create sandbox" quoting:

```text
#19 [stage-1 9/34] RUN set -eu; dcode_path="$(command -v dcode 2>/dev/null || true)"; if [ "$dcode_path" != "/usr/local/bin/dcode" ]; then echo "ERROR: expected dcode at /usr/local/bin/dcode, got ${dcode_path:-missing}" >&2; exit 1; fi; test -x /usr/local/bin/dcode; /usr/local/bin/dcode --version
```

The card stays on screen while the build continues past that step and onboarding completes successfully:

```text
nemoclaw deepagents-code status -> Phase: Ready, Agent: LangChain Deep
Agents Code v0.1.34, Inference reachable
dcode -> starts and answers prompts normally
```

The same trap exists at `stage-1 26/34`, whose RUN body contains the strings `ERROR: NEMOCLAW_TOOL_DISCLOSURE must be progressive or direct` and `ERROR: NEMOCLAW_DCODE_AUTO_APPROVAL must be disabled or thread-opt-in`.

## Analysis

Three behaviours combine:

1. BuildKit writes its progress lines — `#NN [stage-1 x/34] RUN {entire command text}` — to **stderr**, not stdout.
2. `onboard-ui/lib/services/nemoclaw.ts`, `parseOnboardStderr()`, emits a hard `{type:"error"}` event for any stderr line matching:

```text
/\b(error|failed|unauthorized|forbidden|authentication|invalid (?:api )?key|upstream unavailable)\b/i
```

There is no exclusion for BuildKit progress lines and no notion of whether the step later reported `DONE`.
3. `agents/langchain-deepagents-code/Dockerfile` (the dcode path guard, around line 51) contains a sanity check that never fires, whose message text is `echo "ERROR: expected dcode at /usr/local/bin/dcode, got ..."`. BuildKit echoes the whole RUN body, so the literal word `ERROR` appears in a line that then reports `DONE`.

So the UI reacts to the *source text* of a guard rather than to the guard firing.

Note the stdout path does not have this problem: `parseOnboardLine()`'s fallback uses a case-sensitive check for `"Error:"`, which does not match `"ERROR:"`. Only the stderr regex is case-insensitive.

**Suggested fix:** in `parseOnboardStderr()`, skip BuildKit progress lines (`/^#\d+\s/`), or only raise an error on BuildKit's own `ERROR: process "..." did not complete successfully` marker and on a non-zero child exit code.

## Logs

Onboarding UI service log (host names removed), showing the flagged step and the successful continuation of the same build:

```text
[onboard] #19 [stage-1 9/34] RUN set -eu; dcode_path="$(command -v dcode 2>/dev/null || true)"; ... /usr/local/bin/dcode --version
[onboard] #36 [stage-1 26/34] RUN case "progressive" in progressive|direct) ;; *) echo "ERROR: NEMOCLAW_TOOL_DISCLOSURE must be progressive or direct" ...
[onboard] #37 1.703 deepagents-code 0.1.34
[onboard] #37 1.703 deepagents (SDK) 0.7.0a6
[onboard] #37 DONE 2.2s
[onboard] #43 [stage-1 33/34] RUN install -d -m 0755 /usr/local/share/nemoclaw ...
[onboard] #43 DONE 0.7s
[onboard] #44 [stage-1 34/34] RUN set -eu; security_inventory=/usr/local/share/nemoclaw/security-packages.txt; ...
[onboard] #44 DONE 0.3s
[onboard] #45 exporting to image
[onboard] #45 DONE 1.3s
[onboard] Building sandbox image...
[onboard] Waiting for sandbox to become ready...
[onboard] Sandbox reported Ready before create stream exited; continuing.
[onboard] Waiting for sandbox to become ready...
[onboard] * Sandbox 'deepagents-code' created
[onboard] [7/8] Setting up LangChain Deep Agents Code inside sandbox
[onboard] * LangChain Deep Agents Code terminal runtime is ready
[onboard] [8/8] Policy presets
[onboard] Applied preset: npm
[onboard] Applied preset: huggingface
[onboard] Applied preset: brew
[onboard] * LangChain Deep Agents Code terminal runtime is ready
[onboard] Connect: nemoclaw deepagents-code connect
[onboard] Interactive: dcode
```

Anyone who plans to fix one of #8101, #8105 and #8109 should consider to fix them altogether.

Start in onboard-ui/lib/services/nemoclaw.ts with parseOnboardStderr() and compare its stderr handling with the BuildKit lines shown in the issue. Review the dcode guard around line 51 in agents/langchain-deepagents-code/Dockerfile, then verify that successful DONE progress does not create a persistent error card or RETRY action while genuine failures still do.

Written by the indexing model from the issue text.