fix(onboard): stabilize Docker authority across terminals (#9666)

<!-- markdownlint-disable MD041 -->
## Summary
Docker host-local-inference authority no longer includes terminal
presentation metadata. Interactive onboarding and later non-interactive
lifecycle commands now resolve the same persisted authority, while an
actual Docker endpoint change remains denied.

## Related Issue
Fixes #9584

## Changes
- Extend the Docker authority regression test to vary caller terminal
and SSH session metadata while asserting stable authority and binding
IDs.
- Verify that caller metadata is not forwarded without assuming that
macOS `/bin/sh` leaves `TERM` unset.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates
- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: Draft PR; maintainer
review is pending.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## DGX Station Hardware Evidence
- [ ] Tested on DGX Station
- Tested commit: Hardware validation used source snapshot
`2d05bce020821f4909bbaa1312cb6e52df296ebb` plus this exact two-file
patch. The published rebased commit is
`ef6855ab946c720bec2df65600825595135e4120`.
- Station profile/scenario: DGX Spark, NVIDIA GB10, Ubuntu 24.04
aarch64, driver 580.159.03, Docker 29.2.1, OpenShell 0.0.101, Node
24.18.0, npm 11.16.0, OpenClaw 2026.7.1, managed llama.cpp Muse Glimmer
30B.
- Result: Fresh interactive selection succeeded after one supported
`onboard --resume` caused by a validation-harness status probe racing
the initial transition. With `TERM` absent, status and doctor were
healthy and destroy succeeded. A different Docker socket still failed
closed with `Qualified container endpoint does not match persisted
authority`.
- Supporting evidence: `TERM=xterm-256color NEMOCLAW_EXPERIMENTAL=1 node
bin/nemoclaw.js onboard --fresh --name nc9584-cleanfinal
--yes-i-accept-third-party-software`; `TERM=xterm-256color
NEMOCLAW_EXPERIMENTAL=1 node bin/nemoclaw.js onboard --resume
--yes-i-accept-third-party-software`; `env -u TERM node bin/nemoclaw.js
nc9584-cleanfinal status`; `env -u TERM node bin/nemoclaw.js
nc9584-cleanfinal doctor`;
`DOCKER_HOST=unix:///tmp/nc9584-different-docker.sock env -u TERM node
bin/nemoclaw.js nc9584-cleanfinal doctor`; `env -u TERM node
bin/nemoclaw.js nc9584-cleanfinal destroy --yes`. Results were redacted;
validation sandbox, container, bridge process, and listener were cleaned
up. Existing v0.0.110 persisted authority state was not modified.

## Verification
- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run validate:pr` passed after refreshing `origin/main` when hooks
were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — `npx --no-install vitest run --project
cli src/lib/onboard/runtime-provider/docker-operation-authority.test.ts`
(19/19 passed); `npm run test:titles:check`, `npx --no-install oxfmt
--check
src/lib/onboard/runtime-provider/docker-operation-authority.test.ts`,
and `git diff --check` passed; hardware commands/results above.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result: Not applicable; this is a
focused authority environment-filter change with a targeted regression
test.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Prekshi Vyas
<34834085+prekshivyas@users.noreply.github.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Tests**
* Verified managed llama.cpp authority remains stable when onboarding
changes the command path.
* Confirmed invalid or directory-only local OpenShell paths are
rejected.
* Expanded session metadata coverage for caller-provided terminal
settings, ensuring they are not forwarded unchanged to Docker commands.
* Accommodated macOS shell behavior while continuing to verify that XDG
session variables remain unset.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Prekshi Vyas <34834085+prekshivyas@users.noreply.github.com>
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Senthil Ravichandran <senthilr@nvidia.com>

Author: 3 people

src/lib/onboard/runtime-provider/docker-operation-authority.test.ts

@@ -198,34 +198,43 @@ describe("Docker operation authority", () => {
     expect(environment.PATH).toBe("/usr/bin");
   });
 
-  it("keeps authority stable across SSH session metadata and does not forward it", () => {
+  it("keeps authority stable across terminal and SSH session metadata (#9584)", () => {
     const executableRoot = fakeDockerScript(
-      `printf '%s\\n' "\${XDG_SESSION_ID-unset}" "\${XDG_SESSION_CLASS-unset}" "\${XDG_SESSION_TYPE-unset}"`,
+      `printf '%s\\n' "\${TERM-unset}" "\${XDG_SESSION_ID-unset}" "\${XDG_SESSION_CLASS-unset}" "\${XDG_SESSION_TYPE-unset}"`,
     );
     const common = {
       HOME: "/tmp/nemoclaw-home",
       DOCKER_HOST: "unix:///tmp/nemoclaw-docker.sock",
       PATH: executableRoot,
       XDG_RUNTIME_DIR: "/run/user/1000",
     };
+    const callerTerm = "nemoclaw-caller-terminal";
     const first = createDockerOperationAuthority("host-local-inference", {
       ...common,
       XDG_SESSION_ID: "101",
       XDG_SESSION_CLASS: "user",
       XDG_SESSION_TYPE: "tty",
+      TERM: "xterm-256color",
     });
     const second = createDockerOperationAuthority("host-local-inference", {
       ...common,
       XDG_SESSION_ID: "102",
       XDG_SESSION_CLASS: "background",
       XDG_SESSION_TYPE: "unspecified",
+      TERM: callerTerm,
     });
 
     expect(second.engine.authorityId).toBe(first.engine.authorityId);
     expect(dockerOperationBindingSha256(second.engine)).toBe(
       dockerOperationBindingSha256(first.engine),
     );
-    expect(second.engine.capture(["version"]).stdout).toBe("unset\nunset\nunset\n");
+    const [dockerTerm, ...dockerSessionMetadata] = second.engine
+      .capture(["version"])
+      .stdout.trimEnd()
+      .split("\n");
+    // macOS /bin/sh supplies TERM=dumb after NemoClaw removes the caller value.
+    expect(dockerTerm).not.toBe(callerTerm);
+    expect(dockerSessionMetadata).toEqual(["unset", "unset", "unset"]);
   });
 
   it("keeps host-local inference authority stable across terminal attachment changes (#9599)", () => {