Description

When deploying features that need new network access (e.g., Slack bot), the sandbox network policy needs updating. The expected workflow would be:

nemoclaw policy add slack

But the NemoClaw CLI has no policy subcommand — policy management must go through openshell directly, which replaces the entire policy on every set.

Current Workflow

1. Manually inspect the 200+ line existing policy YAML
2. Manually merge the new preset (e.g., presets/slack.yaml) into the existing policy
3. Apply the complete merged file: openshell policy set --policy merged.yaml --wait my-assistant

Missing any existing policy in the merge means silently losing that network access.

Proposed Workflow

nemoclaw policy add slack        # adds Slack preset to current policy
nemoclaw policy add nvidia_forum # adds forum preset
nemoclaw policy list             # shows active policies
nemoclaw policy remove discord   # removes Discord preset

The presets already exist at nemoclaw-blueprint/policies/presets/ — they just need a CLI command to apply them incrementally.