Managed startup profile rejects schema-owned messaging runtime aliases

## Investigation Summary

The complete unfiltered E2E run at latest PR commit `3cf9a57df9fb73ff8c75d75e79864dd2f5ba453e` has six messaging jobs that fail before sandbox startup.

Each job reports:

`Cannot build managed startup profile: Invalid managed startup profile: payload field messaging.plan.runtimeSetup.envAliases[1].value contains credential-shaped string data`

The rejected value is a credential placeholder from the Slack channel manifest. It does not contain credential material.

## Reproduction Steps

1. Dispatch the complete unfiltered E2E workflow at `3cf9a57df9fb73ff8c75d75e79864dd2f5ba453e`.
2. Run the managed Docker messaging targets.
3. Observe onboarding fail while it builds the managed startup profile.

## Environment

- Workflow: [complete unfiltered E2E run 32091896540](https://github.com/NVIDIA/NemoClaw/actions/runs/32091896540)
- Latest PR commit: `3cf9a57df9fb73ff8c75d75e79864dd2f5ba453e`
- Driver: OpenShell Docker driver

## Failure Evidence

- [messaging-providers](https://github.com/NVIDIA/NemoClaw/actions/runs/32091896540/job/95576207241)
- [Hermes isolates Slack credentials and reaches Slack APIs](https://github.com/NVIDIA/NemoClaw/actions/runs/32091896540/job/95576208805)
- [Hermes preserves channels across stop and start](https://github.com/NVIDIA/NemoClaw/actions/runs/32091896540/job/95576208947)
- [OpenClaw shares Slack pairing approval](https://github.com/NVIDIA/NemoClaw/actions/runs/32091896540/job/95576209131)
- [OpenClaw preserves channels across stop and start](https://github.com/NVIDIA/NemoClaw/actions/runs/32091896540/job/95576209189)
- [Messaging rotates one provider token without rebuilding siblings](https://github.com/NVIDIA/NemoClaw/actions/runs/32091896540/job/95576209366)

## Root Cause

The Slack channel manifest declares runtime environment aliases for `SLACK_BOT_TOKEN` and `SLACK_APP_TOKEN`. The messaging compiler places those entries under `messaging.plan.runtimeSetup.envAliases[*]`.

PR #9374 fixed #9355 by accepting schema-owned package pins and agent-render credential placeholders. It did not accept runtime environment alias fields.

The validator therefore rejects the canonical alias `value`. A value-only exception is incomplete because the sibling `match` field also contains `openshell:resolve:env:` and will be rejected next.

## Acceptance Criteria

- The managed startup profile validator accepts canonical `messaging.plan.runtimeSetup.envAliases[*]` entries.
- Each accepted alias must satisfy all of these conditions:
- `envKey` is a valid credential environment name.
- `match` is the canonical anchored OpenShell resolver expression for that `envKey`.
- `value` is an approved credential placeholder for the same `envKey`.
- The validator continues to reject:
- raw credentials;
- malformed or unanchored alias expressions;
- mismatched `envKey`, `match`, and `value` fields;
- credential-placeholder strings at other payload paths.
- Focused regression tests cover both stock Slack aliases and each denial case.
- All six affected jobs pass in a complete unfiltered E2E run.

## Out of Scope

The Discord pairing managed-bootstrap stability failure in job `95576208780` has a different failure signature and requires a separate issue.

## Relationship

- Follow-up to #9355 and #9374.
- Prerequisite for shipping #9323 and completing #9140.
- Related epic: #7744.