Description

[Description]
Inside a sandbox, a plain git clone https:/// fails with "server certificate verification failed" because git does not trust the OpenShell L7 proxy's re-signed certificate.

[Environment]
Device: Ubuntu 22.04
Node.js: v22.22.2
npm: 10.9.7
Docker: Docker Engine 29.4.0 (build 9d7ad9f)
OpenShell CLI: openshell m-dev
NemoClaw: v0.0.22
OpenClaw (inside sandbox): 2026.4.2

[Steps to Reproduce]

1. nemoclaw onboard (name: my-assistant, any provider; Balanced preset tier)
2. nemoclaw my-assistant policy-add github
3. nemoclaw my-assistant connect
4. (inside sandbox) git clone https://github.com/octocat/Hello-World.git /tmp/test-repo

[Expected Result]
Step 4 git clones successfully.

[Actual Result]
Step 4 fails at TLS verification:
sandbox@my-assistant:~$ git clone https://github.com/octocat/Hello-World.git /tmp/test-repo 2>&1
Cloning into '/tmp/test-repo'...
fatal: unable to access 'https://github.com/octocat/Hello-World.git/':
server certificate verification failed. CAfile: none CRLfile: none

The sandbox env DOES advertise the CA bundle, but not in a form git recognizes:
sandbox@my-assistant:~$ env | grep -iE "SSL|CA|CERT"
NODE_EXTRA_CA_CERTS=/etc/openshell-tls/openshell-ca.pem
CURL_CA_BUNDLE=/etc/openshell-tls/ca-bundle.pem
SSL_CERT_FILE=/etc/openshell-tls/ca-bundle.pem
REQUESTS_CA_BUNDLE=/etc/openshell-tls/ca-bundle.pem

Re-running the same clone with GIT_SSL_CAINFO set explicitly succeeds:
sandbox@my-assistant:$ GIT_SSL_CAINFO=/etc/openshell-tls/ca-bundle.pem
git clone https://github.com/octocat/Hello-World.git /tmp/test-repo
Cloning into '/tmp/test-repo'...
remote: Enumerating objects: 13, done.
remote: Total 13 (delta 0), reused 0 (delta 0), pack-reused 13
Receiving objects: 100% (13/13), done.
sandbox@my-assistant:$ ls /tmp/test-repo/
README

Bug Details

[NVB#6103552]