test(e2e): add non-root sandbox smoke test (NVIDIA#3166)

<!-- markdownlint-disable MD041 -->
## Summary
Adds the `test-non-root-sandbox-smoke` test from NVIDIA#2571 — a PR-gate job
that runs the production image under `-security-opt no-new-privileges`
to catch NVIDIA#2472 and NVIDIA#2482 regressions, without OpenShell, NVIDIA_API_KEY,
or live inference.

## Related Issue
Part of NVIDIA#2571

## Changes
- New `test/e2e-non-root-smoke.sh` (host-side bash, no
`openshell`/`nemoclaw` CLI required):
- **Test 1** — entrypoint setup chain completes cleanly under
`--security-opt no-new-privileges` (regression guard for # 2472; passes
a `true` command via the entrypoint's `NEMOCLAW_CMD` exec path so the
gateway-launch branch is bypassed and we don't need the
OpenShell-managed runtime).
- **Test 2** — kernel confirms `NoNewPrivs=1` inside the container
(defends the test itself against silent typos in the docker flag).
- New job `test-non-root-sandbox-smoke` in
`.github/workflows/pr-self-hosted.yaml` — `linux-amd64-cpu4`,
`timeout-minutes: 5`, `needs: build-sandbox-images`, reuses the existing
`isolation-image` artifact.
- Expected results:
```
my-machine@ab1-cdf40-30:~/NemoClaw$ # Run script
bash test/e2e-non-root-smoke.sh
TEST: 1. Entrypoint setup chain completes under --security-opt no-new-privileges
PASS: entrypoint exited 0 under no-new-privileges (NVIDIA#2472 setup chain healthy)
TEST: 2. Kernel confirms NoNewPrivs=1 inside container (defends against silent flag typos)
PASS: kernel confirms NoNewPrivs=1

========================================
  Results: 2 passed, 0 failed
========================================
```
- Upcoming plans:
- **Test 3** — `openclaw tui` does not error with "Missing gateway auth
token" inside a login shell under the same constraint (regression guard
for # 2482) after PR NVIDIA#2485 is merged

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Verification
<!-- Check each item you ran and confirmed. Leave unchecked items you
skipped. Doc-only changes do not require npm test unless you ran it. -->
- [ ] `npx prek run --all-files` passes
- [ ] `npm test` passes
- [ ] Tests added or updated for new or changed behavior
- [ ] No secrets, API keys, or credentials committed
- [ ] Docs updated for user-facing behavior changes
- [ ] `make docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
<!-- DCO sign-off required by CI. Run: git config user.name && git
config user.email -->
Signed-off-by: Hung Le <hple@nvidia.com>

Author: hunglp6d

.github/workflows/pr-self-hosted.yaml

@@ -160,3 +160,23 @@ jobs:
 
       - name: Run port override E2E tests
         run: NEMOCLAW_TEST_IMAGE=nemoclaw-production bash test/e2e-port-overrides.sh
+
+  test-non-root-sandbox-smoke:
+    runs-on: linux-amd64-cpu4
+    timeout-minutes: 5
+    needs: build-sandbox-images
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Download image artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: isolation-image
+          path: /tmp
+
+      - name: Load image
+        run: gunzip -c /tmp/isolation-image.tar.gz | docker load
+
+      - name: Run non-root sandbox smoke test
+        run: NEMOCLAW_TEST_IMAGE=nemoclaw-production bash test/e2e-non-root-smoke.sh

test/e2e-non-root-smoke.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# E2E smoke test for non-root sandbox execution under
+# --security-opt no-new-privileges (issue #2571).
+#
+# Replicates Brev Launchable / DGX Spark's PR_SET_NO_NEW_PRIVS constraint
+# in CI to catch regressions of:
+#
+#   - #2472 (2026-04-25): non-root entrypoint crashed when install_configure_guard
+#     wrote to ~/.bashrc/.profile under Landlock + `set -e` — 5-day outage
+#     invisible to CI. Architecturally gone after #2741 (rc files are now
+#     root:root 444 static shims); this test guards the symptom — entrypoint
+#     exits non-zero under no-new-privileges.
+#
+# (#2482-class detection — `openclaw tui` "Missing gateway auth token" — is
+# deferred to a follow-up PR after #2485 merges, since current main has no
+# token-generation code path in the standalone container.)
+#
+# CAVEAT: no-new-privileges ≠ Landlock. We catch #2472-class bugs only
+# when they manifest as a non-zero entrypoint exit; the original ~/.bashrc
+# write under Landlock is not reproduced. A real Landlock ruleset is future
+# work (#2571).
+#
+# How: ENTRYPOINT=`nemoclaw-start`, CMD=`["/bin/bash"]`. Passing a command
+# to `docker run` overrides CMD; the entrypoint captures it into NEMOCLAW_CMD
+# and exec's it *after* setup (nemoclaw-start.sh:1508 non-root / :1613 root).
+# We pass `true` (Test 1) so setup runs end-to-end without entering the
+# gateway-launch path (which needs OpenShell).
+#
+# Requires: docker
+
+set -euo pipefail
+
+IMAGE="${NEMOCLAW_TEST_IMAGE:-nemoclaw-production}"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+pass() {
+  echo -e "${GREEN}PASS${NC}: $1"
+  PASSED=$((PASSED + 1))
+}
+fail() {
+  echo -e "${RED}FAIL${NC}: $1"
+  FAILED=$((FAILED + 1))
+}
+info() { echo -e "${YELLOW}TEST${NC}: $1"; }
+
+PASSED=0
+FAILED=0
+
+if ! docker image inspect "$IMAGE" >/dev/null 2>&1; then
+  fail "Image $IMAGE not found — load it before running this test"
+  exit 1
+fi
+
+# Helper: run the entrypoint under --security-opt no-new-privileges with
+# a final command of the caller's choice. The command is captured by
+# nemoclaw-start as NEMOCLAW_CMD and exec'd after entrypoint setup.
+# Returns combined stdout+stderr; caller checks $? and/or output.
+run_under_nnp() {
+  docker run --rm --security-opt no-new-privileges "$IMAGE" "$@" 2>&1 || return $?
+}
+
+# ── Test 1: Entrypoint setup completes under no-new-privileges (#2472) ──
+
+info "1. Entrypoint setup chain completes under --security-opt no-new-privileges"
+RC=0
+OUT=$(run_under_nnp true) || RC=$?
+if [ "$RC" -eq 0 ]; then
+  pass "entrypoint exited 0 under no-new-privileges (#2472 setup chain healthy)"
+else
+  fail "entrypoint exited $RC under no-new-privileges — likely #2472-class regression"
+  echo "$OUT" | tail -20 | sed 's/^/  /'
+fi
+
+# ── Test 2: Kernel confirms PR_SET_NO_NEW_PRIVS is applied (sanity) ──
+
+info "2. Kernel confirms NoNewPrivs=1 inside container (defends against silent flag typos)"
+NNP=$(docker run --rm --security-opt no-new-privileges --entrypoint "" "$IMAGE" \
+  sh -c 'grep ^NoNewPrivs /proc/self/status' 2>/dev/null \
+  | awk '{print $2}' || echo "")
+if [ "$NNP" = "1" ]; then
+  pass "kernel confirms NoNewPrivs=1"
+else
+  fail "expected NoNewPrivs=1 inside container, got '${NNP:-<empty>}'"
+fi
+
+# ── Summary ─────────────────────────────────────────────────────
+
+echo ""
+echo -e "${GREEN}========================================${NC}"
+echo -e "  Results: ${GREEN}$PASSED passed${NC}, ${RED}$FAILED failed${NC}"
+echo -e "${GREEN}========================================${NC}"
+
+[ "$FAILED" -eq 0 ] || exit 1