[Jetson AGX Orin][Security] nemoclaw my-assistant shields down fails with file ownership error — snapshot creation blocked

Problem
nemoclaw my-assistant shields down fails with a file ownership error when shields are already in the UP (lockdown) state. The error message prompts the user to "Re-run shields down after correcting file ownership", but no repair command is documented and no corrective action is provided.

As a result, snapshot creation is also blocked because it requires shields to be DOWN first.

Observed
On AGX Orin (R39.2.1, GCID 46548788), NemoClaw v0.0.97, OpenShell 0.0.85, OpenClaw 2026.7.1, sandbox: my-assistant (docker-driver):

$ nemoclaw my-assistant shields down --timeout 5m --reason snapshot-tc
Re-run nemoclaw my-assistant shields down after correcting file ownership.

$ nemoclaw my-assistant snapshot create --name "val-"
Cannot create snapshot while shields are up.
Run nemoclaw my-assistant shields down first, then retry.

$ nemoclaw my-assistant shields up
Lockdown is already active.

Expected
shields down should succeed (or provide an actionable repair command) when the sandbox is in a locked posture. Snapshot creation should proceed after unlocking.

Root cause hint
The shields lockdown workflow locks high-risk state dirs to root:sandbox and removes group/world write access (per docs/security/best-practices.mdx). shields down must restore those to sandbox:sandbox 2770. The file ownership error suggests the restore traversal is failing on at least one entry — possibly a file left in an intermediate owner state by a prior interrupted shields cycle.

Related open bugs
#7977 — shields up cannot lock Deep Agents sandbox (.config-hash missing)
#7727 — missing .config-hash in locked posture blocks destroy after failed rollback

Environment
Device: NVIDIA Jetson AGX Orin Developer Kit
BSP: R39 (REVISION: 2.1), GCID: 46548788, Kernel: 6.8.12-1021-tegra
NemoClaw: v0.0.97 (GitHub lkg)
OpenShell: 0.0.85 (docker-driver)
OpenClaw: 2026.7.1
Sandbox: my-assistant (openclaw agent)
Reproduce: Run nemoclaw-test DevTest 130290 after a shields up/down cycle has been executed in the same session (e.g. DevTest 130291 runs first).

Origin: QA Automated Testing — NemoClaw DevTest 130290

Start by running NemoClaw DevTest 130290 after the shields up/down cycle described, using DevTest 130291 first to reproduce the state. Read docs/security/best-practices.mdx and trace the shields down ownership-restore workflow, focusing on entries left in an intermediate owner state. Done means shields down succeeds or gives an actionable repair command, and snapshot creation proceeds afterward.

Written by the indexing model from the issue text.