Preserve Hermes Portable exclusion from stock managed-runtime activation

## Problem

The stock managed-runtime activation decision currently excludes OpenClaw Portable through `portableLifecycle`, but Hermes Portable is represented separately by `hermesPortableLifecycle`. The call in `src/lib/onboard/sandbox-create/orchestration.ts` passes only `resolvePortableLifecycleMode(agent)` into `shouldActivateStockManagedRuntime`.

As a result, Hermes Portable can select the stock managed runtime even though its lifecycle must retain the shipped Hermes Dockerfile path. The later Hermes Portable guard then encounters a managed-image workload and fails instead of preserving the portable path.

## Required change

- Treat both OpenClaw Portable and Hermes Portable as excluded from stock managed-runtime activation.
- Keep normal managed activation unchanged for shipped non-Portable OpenClaw, Hermes, and Deep Agents Code.
- Add focused regression coverage at the activation decision/call site proving Hermes Portable cannot select managed bootstrap.
- Preserve the existing fail-closed Hermes Portable managed-bootstrap assertion as defense in depth.

## Acceptance criteria

- Hermes Portable selects the legacy shipped Hermes Dockerfile workload, not a managed image.
- OpenClaw Portable remains excluded exactly as before.
- Non-Portable shipped agents still activate stock managed runtime.
- Focused unit tests cover all three cases.

## Relationship

Follow-up preservation fix for #9140 and the cutover in #9323. Implement as a stacked PR based on the #9323 branch; do not broaden the current full-E2E dispatch work.