[OpenShell][DGX Spark][Policy&Network] openshell policy get --full output is still not accepted by policy set — metadata header breaks the round trip again on 0.0.101

> [!WARNING]
> **Regression** — worked in v0.0.109, broken in v0.0.111.

## Description

`openshell policy get {sandbox} --full` prints a metadata header before the policy
document, and `openshell policy set` rejects its own output. The get/set round trip
is broken.

This was reported and closed as fixed on OpenShell 0.0.44 (GitHub #6052, fixed
2026-07-09). It reproduces on OpenShell 0.0.101. The header has changed shape since
then - it was six lines (Version, Hash, Status, Active, Created, Loaded) and is now
five (Version, Hash, Status, Source, Config rev) - but it is still emitted and
`policy set` still fails on the first line.

Workaround: strip everything up to and including the --- separator before setting.
awk 'f{print} /^---$/{f=1}' policy.yaml > policy-clean.yaml
openshell policy set {sandbox} --policy policy-clean.yaml --wait
Accepted: "Policy unchanged (version 4, hash: {policy hash})".

Note on a published workaround that does not work: the DGX Spark playbook prescribes
`sed -i 's/^Version:/version:/' policy.yaml`, which rewrites line 1 only. The next
attempt then fails on line 2 with `unknown field Hash`, and lines 3-5 would follow.
The documentation side is tracked separately as a playbook documentation issue; this
bug is about the round trip itself.

Platform scope: Reproduced on DGX Spark (Ubuntu 24.04 aarch64) with OpenShell 0.0.101; the original report was macOS arm64 with OpenShell 0.0.44, so this is not platform-specific.
Regression: Yes - reported and closed as fixed on OpenShell 0.0.44 (GitHub #6052, fixed 2026-07-09); the same failure is back on OpenShell 0.0.101.
OpenShell issue: Yes - the failing surface is `openshell policy get` / `openshell policy set`, not a NemoClaw-level command.

## Environment

```text
Device: DGX Spark (GB10)
OS: Ubuntu 24.04.3 LTS
Architecture: aarch64
Node.js: v22.22.1
npm: 10.9.4
Docker: 28.3.3
OpenShell CLI: 0.0.101
NemoClaw: v0.0.111
OpenClaw: 2026.7.1
```

## Steps to Reproduce

```bash
1. On a host with a Ready sandbox (my-assistant), dump the live policy:
openshell policy get my-assistant --full > /tmp/policy.yaml
2. Inspect the first lines:
head -8 /tmp/policy.yaml
3. Feed it straight back:
openshell policy set my-assistant --policy /tmp/policy.yaml --wait
```

## Expected Result

`policy set` accepts the output of `policy get --full` unchanged. Either `get --full`
emits a settable document, or `set` tolerates and ignores the metadata header.

## Actual Result

```text
head -8 /tmp/policy.yaml:
Version: 4
Hash: {policy hash}
Status: Effective
Source: sandbox
Config rev: {config revision}
---
version: 1
filesystem_policy:

openshell policy set my-assistant --policy /tmp/policy.yaml --wait:
Error: x failed to parse sandbox policy YAML
|-> unknown field `Version`, expected one of `version`, `filesystem_policy`,
`landlock`, `process`, `network_policies`, `network_middlewares`

After the playbook's sed workaround the next error is:
unknown field `Hash`, expected one of `version`, `filesystem_policy`, `landlock`,
`process`, `network_policies`, `network_middlewares` at line 2 column 1
```

## Logs

```text
Not captured beyond the terminal output above - the failure is deterministic and
fully visible on stdout.
```