Managed startup CA bundle is absent from baseline filesystem policies

## Investigation Summary

- Managed startup exports TLS trust variables to `/run/nemoclaw/managed-startup-ca-bundle.pem`.
- Shipping baseline filesystem policies do not grant read access to that exact file.
- The failing Deep Agents artifact proves strict Landlock enforcement is active and the effective policy omits the managed CA path.
- OpenClaw and Deep Agents private-TLS MCP discovery fail before the fixture receives any request.
- A pre-cutover run passed with the same policy because the rebuilt image supplied trust from policy-readable system paths.

## Description

The buildless managed-startup path moved the active merged CA bundle to `/run/nemoclaw/managed-startup-ca-bundle.pem`, but the agent baseline filesystem policies still allow only the pre-cutover trust locations.

Expected behavior: each shipping managed agent can read the exact managed CA file while mutable receipts and locks under `/run/nemoclaw` remain inaccessible.

Actual behavior: trusted-private TLS fails before the MCP fixture receives an HTTP request. The discovery runtime reports only `MCP tool discovery request failed`.

## Reproduction Steps

1. Onboard managed OpenClaw or LangChain Deep Agents Code with the private-CA MCP fixture.
2. Apply the shipping strict filesystem policy.
3. Run authenticated MCP tool discovery.
4. Observe `toolDiscovery: { ok: false, count: 0, tools: [] }` and an empty fixture request ledger.

## Environment

- Workflow: [unfiltered E2E run 32068537791](https://github.com/NVIDIA/NemoClaw/actions/runs/32068537791)
- Runner: GitHub-hosted Ubuntu
- Runtime: OpenShell Docker driver with strict Landlock policy
- Candidate commit: `eb560abae63f89183406b3cc273ecb8bf12ccfd2`
- Pre-cutover comparison: [passing run 31547214826](https://github.com/NVIDIA/NemoClaw/actions/runs/31547214826)

## Failure Evidence

- [OpenClaw MCP bridge](https://github.com/NVIDIA/NemoClaw/actions/runs/32068537791/job/95506674753)
- [Deep Agents MCP bridge](https://github.com/NVIDIA/NemoClaw/actions/runs/32068537791/job/95506674854)
- Deep Agents effective policy grants `/run/nemoclaw-dcode-mcp` but not `/run/nemoclaw/managed-startup-ca-bundle.pem`.
- Both current private-TLS fixture ledgers contain no requests.

The current Deep Agents artifact does not expose the underlying errno. Active Landlock, the omitted exact path, the pre-fixture failure, and the pre-cutover comparison make this a high-confidence path-policy diagnosis.

## Acceptance Criteria

- Every shipping managed-agent baseline and permissive policy grants read-only access to the exact managed CA file.
- The policies do not grant access to the mutable `/run/nemoclaw` directory as a whole.
- Missing, replaced, or non-root-owned CA material still fails closed.
- OpenClaw and Deep Agents private-TLS MCP discovery each return the two expected tools.
- A real-policy test proves the exact read-only grant for every shipping agent policy.

## Relationship

Prerequisite for #9140. Related epic: #7744. Related but distinct: #8454, #9357, and historical symptom #8746.

Start with the shipping managed-agent baseline and permissive filesystem policies, then reproduce the strict Landlock failure using the linked OpenClaw and Deep Agents MCP bridge runs. Verify the exact managed CA file receives read-only access without broad /run/nemoclaw access, and use the private-TLS discovery scenarios to confirm both agents return the two expected tools while invalid CA material still fails closed.

Written by the indexing model from the issue text.