Buildless onboarding E2E requires legacy build and recreation output

## Investigation Summary

- The full OpenClaw E2E target completes install, onboarding, inference, CLI operations, and cleanup, then fails because it did not use BuildKit.
- Hermes native and compatibility GPU targets prove GPU access, stable Ready state, and a healthy Hermes gateway.
- Both Hermes targets then fail because installer output omits legacy Docker-container recreation text.
- The managed-image cutover intentionally removes both legacy construction paths.
- No existing issue matches these stale assertions.

## Description

Three E2E assertions treat legacy Dockerfile construction and container-recreation progress text as required behavior. Buildless managed onboarding is expected to bypass those paths.

Expected behavior: the tests assert managed-image identity and user-visible runtime outcomes, including that stock onboarding performs no Dockerfile build.

Actual behavior: functionally successful managed onboarding fails because legacy output is absent.

## Reproduction Steps

1. Run stock managed OpenClaw full E2E onboarding.
2. Observe successful install, onboarding, inference, CLI operations, and cleanup.
3. Observe: `expected the cold install to use BuildKit`.
4. Run Hermes native or compatibility GPU startup.
5. Observe successful GPU proof and healthy Hermes gateway, followed by an assertion for `Recreating OpenShell Docker sandbox container...`.

## Environment

- Workflow: [unfiltered E2E run 32068537791](https://github.com/NVIDIA/NemoClaw/actions/runs/32068537791)
- Runners: GitHub-hosted Ubuntu and accessible NVIDIA GPU runners
- Runtime: OpenShell Docker driver with managed OpenClaw and Hermes
- Candidate commit: `eb560abae63f89183406b3cc273ecb8bf12ccfd2`

## Failure Evidence

- [OpenClaw full E2E](https://github.com/NVIDIA/NemoClaw/actions/runs/32068537791/job/95506677470)
- [Hermes native GPU startup](https://github.com/NVIDIA/NemoClaw/actions/runs/32068537791/job/95506674827)
- [Hermes compatibility GPU startup](https://github.com/NVIDIA/NemoClaw/actions/runs/32068537791/job/95506674654)

## Acceptance Criteria

- Full E2E proves stock onboarding uses the selected immutable managed image and performs no Dockerfile build.
- Hermes GPU startup asserts GPU access, stable Ready state, and healthy agent startup without requiring incidental progress text.
- Explicit custom `--from ` coverage continues to prove the separate opt-in build path.
- All three affected targets pass in the complete unfiltered E2E run.

## Scope Boundary

Do not add a legacy build or recreation step. Do not publish a new managed image.

## Relationship

Prerequisite for #9140. Related epic: #7744. Related but not duplicate: #8720.