Deep Agents live E2E loses base-resolution metadata after lifecycle checks

## Description

The current-main Deep Agents Code live target completes its target-specific cloud checks, then fails while recording final evidence because the sandbox image has no base-resolution metadata.

Evidence:

- Current-main run: https://github.com/NVIDIA/NemoClaw/actions/runs/32084959556
- Failed job: https://github.com/NVIDIA/NemoClaw/actions/runs/32084959556/job/95557476809
- Exact run head: `1eb20916e6be25dae1500e5c62c1595c285789f1`

The target reports:

```text
run target-specific cloud checks — passed
record target completion evidence — failed
Error: Deep Agents Code sandbox image is missing base resolution metadata
```

The job's earlier `ModuleNotFoundError: No module named 'deepagents'` belongs to the intentional missing-dependencies negative fixture. It is not the final test failure and is not evidence that the trusted base image lacks the package.

## Failure seam

`test/e2e/live/dcode-base-image-runtime-evidence.ts` requires immutable base-resolution metadata from the final Deep Agents Code sandbox image. `verifyDcodeBaseImageRuntimeEvidence` receives no metadata after the lifecycle completes and fails closed.

Merged #9262 previously added platform-digest preservation, but this current-main result shows that the complete target can still finish without the required metadata reaching final evidence.

## Expected behavior

The Deep Agents Code lifecycle preserves the exact published base-image resolution metadata through onboarding and rebuild, and final evidence binds the sandbox to the expected immutable platform digest.

## Acceptance criteria

- Preserve base-resolution metadata on the final Deep Agents Code sandbox image through the complete lifecycle.
- Keep repository, platform, manifest, and immutable digest validation strict.
- Do not bypass or make the final evidence optional.
- Add regression coverage for the metadata-loss path.
- Confirm `ubuntu-repo-cloud-langchain-deepagents-code` passes twice on the repaired exact head.

Prerequisite for #9140.
Related to #7744.

Start in test/e2e/live/dcode-base-image-runtime-evidence.ts and trace how verifyDcodeBaseImageRuntimeEvidence receives data after onboarding and rebuild. Reproduce the exact-head Deep Agents Code live target, then follow the metadata through the lifecycle. Done means strict repository, platform, manifest, and immutable digest checks pass, regression coverage covers metadata loss, and ubuntu-repo-cloud-langchain-deepagents-code passes twice.

Written by the indexing model from the issue text.