Phase 2 slice 10: Reconcile transports and remove superseded CLI methods

> [!WARNING]
> this issue is pending scoping and should only be picked up by rsliter.

Parent Epic: #9802

## Outcome

Complete Phase 2 by recording the selected transport for every OpenShell capability and removing only CLI methods superseded by proven SDK or gRPC implementations.

## Draft scope

- Reconcile all 44 OpenShell operation contracts against the exact SDK, protobuf, gateway, and CLI release selected by Phase 2 Slice 1.
- Confirm that each migrated capability has shared contract evidence and any required live evidence.
- Apply `SDK > gRPC > CLI` to each capability and record the reason for every retained CLI path.
- Remove CLI methods and compatibility parsers only when no in-scope consumer or executable-level exception still needs them.
- Keep local gateway registry and process lifecycle, detached port forwards, file transfer, terminal and OpenSSH connection behavior, local image-build composition, and install or version behavior on the CLI when no equivalent RPC exists.
- Verify that consumers receive only NemoClaw-owned request, result, and error types.
- Recheck package, lockfile, registry, generated-code, protobuf, gateway, and runtime identities at the latest PR commit.

## Acceptance evidence

- Every OpenShell operation has one disposition: SDK, direct gRPC, maintained CLI, or approved executable-level exception.
- Every migrated capability uses the highest-priority transport with proven semantic parity.
- No obsolete CLI implementation, raw parser, or transport-selection branch remains for migrated capabilities.
- No mutation uses automatic cross-transport fallback.
- User-visible behavior, security controls, recovery, and cleanup remain unchanged.

## Test plan

- Complete shared contract suite for every selected implementation.
- Static repository checks for direct CLI bypasses and SDK or protobuf type leaks.
- Package-contract, CLI, plugin, generated-code, and dependency-selector validation.
- Concern-specific live evidence for authentication, policy, credentials, mutations, runtime processes, and cleanup.

## Dependencies and sequencing

Blocked by every prior Phase 2 slice. This is the closure issue, not a place to finish an incomplete capability migration.

## Deferred scope

- Capabilities without released SDK or gRPC parity.
- Future upstream SDK roadmap items.
- New NemoClaw behavior unrelated to transport replacement.