[All Platforms][CLI&UX] Multiple error paths surface uncaught Node.js exceptions / un-actionable diagnostics instead of clean errors

## Description

Several NemoClaw error paths surface a raw, uncaught Node.js exception (full stack trace ending in `Node.js vXX`) or a near-empty/un-actionable diagnostic, instead of a clean single-line actionable error. Shared root cause (missing top-level catch / unpopulated failure diagnostics). Filing as one tracking bug — it's a systemic error-handling-quality issue across distinct code paths.

**Instances observed during v0.0.101 day-0 testing:**

1. **Base-image override rejection** (tracked separately as #8102): bogus `NEMOCLAW_HERMES_SANDBOX_BASE_IMAGE_REF` → uncaught `SandboxBaseImageResolutionError` + stack trace. *(Verified.)*
2. **Symlinked/untrusted gateway unit refusal** (T6264895 Part D): onboarding against a symlinked gateway user service is correctly refused, but via an uncaught `OpenShellGatewayServiceTrustError` + full Node stack trace, not a clean message.
3. **Snapshot create with python3 absent** (T6264853 Part F): raw unhandled Node stack trace (`Credential sanitization failed` / `Failed to inspect snapshot artifacts safely`), never states python3 is the missing prerequisite.
4. **Sandbox-build-failure diagnostics** (T6233692, macOS): near-empty `onboard-failures/.../summary.txt` (`gateway_log=not-found`, `console_output=unknown`) + a truncated Dockerfile (`[diagnostic truncated]`) instead of the failing step's real error.

**Platform scope:** Observed across DGX Spark (aarch64), x86_64 Linux (A100), macOS Apple Silicon; NemoClaw v0.0.101. Not platform-specific.

## Expected Result
Each path prints a clean, single-line, actionable error (e.g. "Refusing symlinked gateway unit …", "python3 is required for snapshot sanitization; install python3 and retry", or a build-failure summary that names the failing step + its real error). No uncaught Node.js stack trace reaches the user; diagnostic summaries are populated with the real cause.

## Actual Result
Uncaught exceptions with full Node.js stack traces (instances 1–3) and near-empty/truncated diagnostics (instance 4). Per-instance evidence in the v0.0.101 day-0 reports; #8102 for instance 1.