Phase 2 slice 2: Migrate gateway health and information to SDK and gRPC

> [!WARNING]
> this issue is pending scoping and should only be picked up by rsliter.

Parent Epic: #9802

## Outcome

Use the curated SDK and main-service gRPC client for gateway health and information reads that satisfy the Phase 1 contracts.

## Draft scope

- Identify read-only consumers of `openshell status`, `openshell gateway info`, and global gateway configuration reads.
- Use the curated SDK health method when it provides the required result.
- Use `client.raw` for released main-service information and configuration RPCs without curated equivalents.
- Map transport status and protobuf messages to NemoClaw-owned results and errors.
- Target the gateway recorded by NemoClaw. Do not infer the target from ambient CLI selection.
- Retain local gateway registration, selection, removal, process lifecycle, and recovery on the CLI.

## Acceptance evidence

- Healthy, degraded, unreachable, authentication-failed, and timed-out results remain distinct where the upstream contract distinguishes them.
- Gateway information identifies the gateway that NemoClaw requested.
- Missing or malformed gateway information cannot become ownership or readiness evidence.
- TLS and authentication failures remain redacted and fail closed.
- A health failure cannot trigger lifecycle recovery that requires stronger ownership evidence.

## Test plan

- Shared CLI, SDK, and gRPC contracts for gateway health and information.
- SDK and gRPC tests for gateway targeting, status mapping, timeout, cancellation, and redaction.
- Existing gateway readiness, status, drift, and recovery tests.
- Focused live evidence for TLS, authentication, and gateway identity boundaries.

## Dependencies and sequencing

Blocked by Phase 2 Slice 1.

## Deferred scope

- Local gateway registry and selected-gateway state.
- Local gateway process lifecycle and recovery.
- Gateway configuration mutations without a current consumer and parity contract.