[DGX Spark][Sandbox] rebuild throws uncaught 'Gateway lifecycle authority changed' and deadlocks all recovery for a sandbox onboarded across the gateway-service migration

## Description
A sandbox whose recorded gateway authority is `packaged-service` (onboarded while the legacy `openshell-gateway.service` was present) cannot be rebuilt after the managed gateway migrates to `standalone` (`nemoclaw-openshell-gateway.service`). `nemoclaw {sandbox} rebuild --yes` backs up state, then throws an **uncaught** exception `Gateway lifecycle authority changed since onboarding (…packaged-service -> …standalone)` from `resolveGatewayEffectAuthority` and aborts.

With managed MCP servers present this is a full **recovery deadlock**: `rebuild --yes`, `onboard --recreate-sandbox` (points back to rebuild), and `{sandbox} destroy --yes` (throws in MCP-bridge teardown) all fail. Recovery required out-of-band steps (restore config bytes + `docker restart`).

Confirmed conditional: a sandbox onboarded AFTER the migration (recorded `standalone`) rebuilds cleanly on the same host. Affects users who onboarded before/during the `openshell-gateway.service → nemoclaw-openshell-gateway.service` migration and then upgrade.

**Platform scope:** Reproduced on DGX Spark (GB10, aarch64), NemoClaw v0.0.100. Not believed platform-specific.

## Environment
```text
Device: DGX Spark (GB10, aarch64) OS: Ubuntu 24.04 Node: v22.22.1
Docker: 28.3.3 OpenShell: 0.0.85 NemoClaw: v0.0.100 Hermes Agent: v0.19.0
```

## Steps to Reproduce
1. On a host where legacy `openshell-gateway.service` is the active managed gateway (authority `packaged-service`), onboard a NemoHermes sandbox (optionally add a managed MCP server).
2. Migrate the managed gateway to standalone `nemoclaw-openshell-gateway.service` (e.g. a NemoClaw upgrade), so live authority becomes `standalone`.
3. `nemoclaw {sandbox} rebuild --yes`; capture output + exit code.
4. Also try `nemoclaw onboard --recreate-sandbox` and `nemoclaw {sandbox} destroy --yes`.

## Expected Result
`rebuild --yes` handles the recorded-vs-live authority migration gracefully (re-bind or clear single-line failure), rebuilds, and leaves a working recovery path. No uncaught exception; destroy/recreate must not also deadlock.

## Actual Result
```text
Error: Gateway lifecycle authority changed since onboarding
(nemoclaw-18080@18080:nemoclaw-managed:packaged-service -> nemoclaw-18080@18080:nemoclaw-managed:standalone).
at resolveGatewayEffectAuthority (.../onboard/gateway-teardown-authority.js:80:15)
```
All sanctioned recovery paths fail (rebuild / recreate-sandbox / destroy). A sandbox onboarded after the migration rebuilds fine, confirming the trigger is the authority drift.