Phase 1 slice 11: Complete the OpenShell CLI consumer sweep

> [!WARNING]
> this issue is pending scoping and should only be picked up by rsliter.

Parent Epic: #9802

## Outcome

Complete the Phase 1 consumer sweep so every production OpenShell CLI operation uses the typed interface or has an explicit executable-level exception.

## Draft scope

- Re-run the production OpenShell operation inventory across `src/`, `nemoclaw/src/`, and approved operational entry points.
- Record the final disposition and owning follow-on for consumers explicitly accepted as out of scope by earlier slices.
- Migrate remaining plugin and production consumers using the capability contracts from earlier slices.
- Classify installer, build, diagnostics, E2E, and repository scripts as interface consumers or intentional executable-level exceptions.
- Delete shared subprocess primitives only after their final supported consumer is gone.
- Record the final disposition of all 44 known operation contracts.

## Acceptance evidence

- No in-scope production consumer constructs OpenShell argv or parses raw CLI output outside the CLI implementation.
- Each remaining direct executable call has a named owner, consumer, reason, and protecting test.
- No duplicate legacy and adapter implementation remains for a migrated capability.
- The CLI implementation remains the selected backend for all Phase 1 operations.

## Test plan

- Static repository check for prohibited direct OpenShell process calls in in-scope paths.
- Package-contract and plugin tests for compiled entry points.
- Targeted tests for each migrated final consumer.
- `npm run test:changed`, CLI and plugin type checks, and the broader validation selected by the final diff.

## Dependencies and sequencing

Blocked by Slices 1 through 10. This issue verifies final dispositions after capability work lands. It does not reimplement deferred consumers or keep an earlier capability issue open after that issue meets its own acceptance criteria.

## Deferred scope

- The SDK implementation and Phase 2 backend selection.
- Approved installer, build, E2E, and diagnostic exceptions.
- New OpenShell capabilities.

## Recorded disposition: policy and sandbox settings (#9805)

Owner: @rsliter. The accepted `src/` consumer migration is complete in #11483 and #11585. Follow-on #11479 is closed.

- Ordinary policy reads, inspection, historical reads, document-based writes, and the logs/exec audit-setting callers use asynchronous typed adapters.
- Portable onboarding, lifecycle qualification/requalification, startup, and uninstall policy observation now await the adapter. Existing locks and transaction authority remain held across observation.
- The transitional synchronous policy reader was removed after its final `src/` consumer migrated.
- SDK-backed configuration export from #11345 is preserved. Further SDK policy expansion belongs to #9826.

This issue retains ownership of plugin consumers in `nemoclaw/src/blueprint/runner.ts` and `nemoclaw/src/blueprint/snapshot.ts`, shared helpers they still need, and final executable-consumer classification. Installer, build, diagnostic, E2E, and repository scripts remain outside #9805's accepted scope. Their classification is pending this issue's scoped sweep; this record does not approve new exceptions or expand implementation scope.

Validation and review evidence remain in the two merged PRs. #9805 requires no further implementation.