[Epic #7744 1/6][B3-E] Activate supported buildless managed onboarding

[ericksoa]

Outcome

Make stock managed onboarding buildless for OpenClaw, Hermes, and LangChain Deep Agents Code. Use complete immutable managed-image digests for each supported architecture.

Dependencies

• Parent epic: [Epic] Support native Podman with buildless managed onboarding #7744
• Completed buildless foundation: refactor(onboard): separate compute driver from gateway launcher (#7747) #9125 through feat(onboard): gate buildless managed workloads (#8261) #9133
• The complete all-agent buildless qualification matrix must pass before activation.
• Qualification-harness prerequisite discovered during matrix execution: ci(e2e): retry transient collaborator-permission reads in trusted dispatch #9337 (bounded transient collaborator-permission retries).
• Qualification-harness prerequisite discovered during matrix execution: ci(e2e): bound transient exact-artifact downloads in the trusted base-image gate #9340 (bounded exact-artifact content retries).
• Qualification prerequisite discovered during the full matrix: ​ #9341 (inject the exact PR managed-image catalog into all stock-onboarding lanes).

Acceptance criteria

• Stock managed onboarding performs no Dockerfile build.
• OpenClaw, Hermes, and LangChain Deep Agents Code pass on linux/amd64 and linux/arm64.
• Immutable all-agent image cohorts and nonroot agent identity are verified.
• Restart, rebuild, snapshot and restore, clone, backup, recovery, rollback, and exact bootstrap receipts pass.
• Docker, macOS, WSL, gateway-isolation, messaging, and security regressions pass.
• User documentation matches the activation evidence.

Scope boundary

• Explicit user-supplied --from Dockerfiles remain a separate opt-in path.
• This issue does not register or advertise native Podman.

Delivery position

1 of 6 remaining epic batches. This batch owns B3-E supported buildless activation.