[Epic] Deliver the Express Installer for Jetson AGX Thor

## Objective

Deliver a repeatable Express installation and qualification path for a supported Jetson AGX Thor configuration.

A user should be able to start from a fresh supported system, use the standard NemoClaw installer, accept the Express path, and reach a working agent without custom repository patches, manual sandbox-image builds, or undocumented host changes.

## Current gaps

The current AGX Thor path can fall back to an incompatible local sandbox-image build and fail during sandbox creation, as tracked by #3508.

Completion also requires trusted evidence from physical Jetson hardware. #8142 owns the shared hardware-execution and evidence path. Implementation may proceed independently, but this Epic cannot complete until #8142 establishes that path or records an accepted replacement.

The IGX Orin GPU-access failure in #7610 informs negative testing, but it does not expand this Epic beyond AGX Thor.

## Scope rules

- Limit the supported platform claim to Jetson AGX Thor and an explicitly qualified software configuration.
- Use the standard NemoClaw installer and hardware-detected Express flow. Do not create a separate Thor-only installer or command family.
- Document the supported operating system, JetPack, architecture, container runtime, OpenShell, driver, and NemoClaw versions.
- Reject unsupported or ambiguous configurations before downloads, host mutation, sandbox creation, or inference setup.
- Use immutable, qualified installation artifacts and serving recipes. Do not rely on an unsupported host-local sandbox-image build.
- Verify GPU access from the actual non-root sandbox user, not only from the host or a root container process.
- Preserve the standard onboarding, status, diagnostics, resume, recovery, and cleanup behavior.
- Bind qualification evidence to the exact NemoClaw revision, hardware, software matrix, artifacts, and selected inference configuration.
- Keep the work best effort and non-gating. If the supported path cannot be qualified, record the exact remaining gap and formally defer it rather than broadening the support claim.

## User journey

1. The user runs the standard NemoClaw installer on a supported Jetson AGX Thor.
2. NemoClaw identifies the platform and validates the supported configuration.
3. The installer offers the existing Express path and shows the selected agent, inference configuration, artifacts, and expected host changes.
4. NemoClaw completes installation and creates the sandbox using qualified artifacts.
5. The sandbox proves GPU access using its normal non-root user.
6. The selected inference path starts and the agent completes a documented task.
7. Status, diagnostics, recovery, and cleanup operate through the normal NemoClaw lifecycle.

## Completion criteria

- [ ] The exact supported Jetson AGX Thor hardware and software matrix is documented.
- [ ] A fresh supported system is detected correctly and offered the standard Express flow.
- [ ] Unsupported configurations fail before downloads or host and sandbox mutation.
- [ ] #3508 is resolved and the installer no longer falls into the failing unsupported local-build path.
- [ ] Sandbox creation succeeds using immutable qualified artifacts.
- [ ] The normal non-root sandbox user passes the required GPU-access proof.
- [ ] The selected inference configuration starts and a documented agent task completes.
- [ ] Status, diagnostics, resume, recovery, and cleanup preserve the selected configuration.
- [ ] Trusted physical-hardware evidence records the exact revision, platform, artifacts, and observed results.
- [ ] Installation, recovery, limitations, and supported configurations are documented.
- [ ] Any incomplete work is explicitly deferred without blocking the other Q3 roadmap deliverables.

## Non-goals

- Support for Jetson Orin, IGX Orin, or every Jetson platform.
- Owning the general Jetson CI and hardware-dispatch infrastructure tracked by #8142.
- Creating a Thor-specific parallel installer or lifecycle.
- Claiming support for unqualified JetPack, runtime, driver, model, or hardware combinations.
- Refactoring unrelated Jetson, OpenShell, container-runtime, or inference behavior.