#2181) (#2208)

## Summary

Fixes a security bug where `/tmp/nemoclaw-proxy-env.sh` was writable by
the sandbox user (`chmod 644`), allowing a sandbox-resident attacker to
append arbitrary shell code that executes on every `nemoclaw <name>
connect` via `.bashrc`/`.profile` sourcing. Introduces shared helpers to
prevent this class of bug going forward.

## Related Issue

Fixes #2181

## Changes

- **`scripts/nemoclaw-start.sh`**: Add `emit_sandbox_sourced_file()`
helper — centralizes `rm -f` (anti-symlink), content write, `chown
root:root`, and `chmod 444` into one reusable function for any file that
the sandbox user sources but must not modify
- **`scripts/nemoclaw-start.sh`**: Add `validate_tmp_permissions()` gate
— defence-in-depth check called before launching services in both root
and non-root paths, verifying proxy-env.sh is 444 and log files are 600
- **`scripts/nemoclaw-start.sh`**: Refactor proxy-env.sh generation to
pipe through `emit_sandbox_sourced_file` instead of ad-hoc `chmod 644`
- **`scripts/nemoclaw-start.sh`**: Add trust boundary map comment
documenting every `/tmp` file, its intended owner, mode, and whether it
is sourced by `.bashrc`/`.profile`
- **`test/service-env.test.ts`**: Add `extractEmitHelper()`, update all
sed anchors from `chmod 644` to `emit_sandbox_sourced_file`, add
permission assertion (`expect 444`)
- **`test/e2e-gateway-isolation.sh`**: Add Test 25 (sandbox user cannot
append to proxy-env.sh) and Test 26 (file permissions are 444
root-owned)
- **`Dockerfile.base`**: Update comment to reflect mode 444

### Architectural context

This is the same class of bug as #2125 (`.bashrc`/`.profile` missing
`chmod 444`) and #799 (audit logs writable). The shared helpers
introduced here (`emit_sandbox_sourced_file`,
`validate_tmp_permissions`) are designed to prevent the whack-a-mole
pattern where each new `/tmp` file independently invents its own
permission management. They map directly to s6-overlay `fix-attrs.d/`
entries for a future entrypoint decomposition.

A tracking issue for migrating the remaining ad-hoc `chmod`/`chown`
callsites and evaluating s6-overlay adoption will follow.

## Type of Change
- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Verification
- [x] `npx prek run --all-files` passes (shellcheck, hadolint, shfmt,
gitleaks, commitlint all pass; tsc/vitest skip due to incomplete npm
install in worktree)
- [ ] `npm test` passes (vitest not installed in worktree — CI will run)
- [x] Tests added or updated for new or changed behavior
- [x] No secrets, API keys, or credentials committed
- [ ] Docs updated for user-facing behavior changes
- [ ] `make docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

## AI Disclosure
- [x] AI-assisted — tool: Claude Code (pi agent)

---
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Security Improvements**
* Enforce and document that sandbox-sourced temp config files are
created root-owned and read-only; added pre-start validation to fail
startup if temp/config or log permissions are incorrect.
* **Tests**
* Expanded end-to-end and unit tests to assert read-only enforcement,
prevent symlink-following attacks, and updated test ordering and labels.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
Co-authored-by: Carlos Villela <cvillela@nvidia.com>