Description
During curl|bash install on Linux (verified on aarch64, likely all platforms), the installer prints the same [INFO] Created user-local shim line twice in a row when creating the user-local CLI shim. This is purely cosmetic — install completes successfully — but the duplicate output is confusing and suggests the shim is being created twice. Root cause confirmed in v0.0.38 source: ensure_cli_shim() is called from two places in the install flow, both writing the same shim file and emitting the same log line.

Environment
Build: NemoClaw v0.0.38 (latest at time of report)
OpenShell CLI: 0.0.36
Host: galaxy-sku2-018
OS: Ubuntu 24.04.4 LTS
Kernel: Linux 6.17.0-1014-nvidia-64k aarch64
Architecture: aarch64
Docker: 29.2.1
Install method: bash /tmp/nemoclaw-installer.sh --non-interactive --yes-i-accept-third-party-software
(equivalent to curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash -s -- ...)

Steps to Reproduce

1. On a clean host (no prior NemoClaw install):
   rm -rf ~/.nemoclaw ~/.openclaw ~/.local/bin/nemoclaw ~/.local/bin/openshell

2. Run curl|bash install non-interactively:
   curl -fsSL https://www.nvidia.com/nemoclaw.sh -o /tmp/installer.sh
   bash /tmp/installer.sh --non-interactive --yes-i-accept-third-party-software 2>&1 | tee /tmp/install.log

3. Grep the log for the shim creation line:
   grep -c "Created user-local shim" /tmp/install.log

Expected Result
The "Created user-local shim at ..." INFO line appears at most once per install run. The shim creation step is idempotent — if the shim already exists with the same target, the log line is suppressed or emitted only once across the install flow.

Actual Result
The INFO line is printed twice in a row. Grep shows count = 2 at adjacent line numbers, and the surrounding context confirms both lines are emitted back-to-back during the shim creation phase:

$ grep -c "Created user-local shim" /tmp/install.log
  2

  $ grep -n "Created user-local shim" /tmp/install.log
  95:[INFO]  Created user-local shim at /localhome/local-mercl/.local/bin/nemoclaw
  96:[INFO]  Created user-local shim at /localhome/local-mercl/.local/bin/nemoclaw

  Surrounding context (lines 85-98):
    found 0 vulnerabilities
    [INFO]  Installing OpenShell CLI
    [install] Detected Linux (aarch64)
    [install] Installing openshell CLI...
    [install] Verifying SHA-256 checksum...
    openshell-aarch64-unknown-linux-musl.tar.gz: OK
    [install] Installed openshell to /localhome/local-mercl/.local/bin/openshell (user-local path)
    [install] For future shells, run: export PATH="..."
    [install] Add that export to your shell profile, or open a new shell before using openshell directly.
    [install] openshell 0.0.36 installed
    [INFO]  Created user-local shim at /localhome/local-mercl/.local/bin/nemoclaw   (1st)
    [INFO]  Created user-local shim at /localhome/local-mercl/.local/bin/nemoclaw   (2nd)
    [INFO]  Verified: nemoclaw is available at /localhome/local-mercl/.local/bin/nemoclaw

Root Cause (confirmed in v0.0.38 source)
scripts/install.sh defines ensure_cli_shim() at lines 989-1031, which writes the shim to ${NEMOCLAW_SHIM_DIR}/${cli_bin} and unconditionally logs the INFO line. The function is invoked from two call sites in the install flow — install_nemoclaw at line 1410 and verify_nemoclaw at line 1438 — and both code paths execute on a fresh install, overwriting the same shim file and emitting the same INFO line. Suggested Fix Make ensure_cli_shim idempotent on the log side — read the existing shim content and skip both the rewrite and the log emission when it already matches what would be written:

if [[ -x "$shim_path" ]]; then
    local expected new
    new=$(cat "$shim_path" 2>/dev/null)
    if [[ "$(printf '%s' "$expected")" == "$new" ]]; then
      return 0   # already in place: no rewrite, no log line
    fi
  fi

Alternatively, remove the redundant call site at install.sh:1438 — the verify_nemoclaw branch can rely on the shim already created by install_nemoclaw at line 1410.

Notes
Discovered during a runtime verification session for unrelated NVBugs on host galaxy-sku2-018 (NemoClaw v0.0.38). Reproducible deterministically on every install run; not a transient.