Phase 2 slice 3: Migrate sandbox policy and configuration to SDK and gRPC

> [!WARNING]
> this issue is pending scoping and should only be picked up by rsliter.

Parent Epic: #9802

## Outcome

Use the curated SDK and main-service gRPC client for sandbox policy and configuration operations that satisfy the Phase 1 contract.

## Draft scope

- Map curated `getConfig` and `setPolicy` behavior to NemoClaw-owned policy requests and results.
- Use `client.raw` for released policy status or history RPCs without curated equivalents.
- Preserve policy source, effective value, version, hash, wait, and concurrency semantics for each migrated consumer.
- Keep policy file loading and merge decisions in NemoClaw when the current contract can be reproduced without the CLI.
- Retain CLI-specific `--base` and `--full` behavior when no SDK or gRPC contract provides equivalent state.
- Run shared policy contracts against each selected implementation.

## Acceptance evidence

- Equivalent configuration reads return the same policy source, version, settings, and effective decisions.
- A successful update observes the expected applied policy hash or revision before returning success.
- Malformed, rejected, conflicting, timed-out, and inconclusive updates cannot become success.
- Static policy fields cannot be weakened through a sandbox-scoped update.
- A timed-out policy mutation is reconciled before retry and never falls back to another transport automatically.

## Test plan

- Shared CLI, SDK, and gRPC policy and configuration contracts.
- SDK and gRPC tests for conversion, concurrency, wait, timeout, cancellation, and typed errors.
- Existing policy, CUA readiness, configuration, and policy-channel tests.
- Focused live evidence for policy application and denied network behavior.

## Dependencies and sequencing

Blocked by Phase 2 Slice 1. The sandbox lifecycle slice also depends on this policy contract.

## Deferred scope

- Local gateway registration and lifecycle.
- Sandbox log settings.
- CLI policy methods without semantic parity.