Closes NVIDIA#3342, CVE-2024-37032 / CNVD-2025-04094.

Background: the `OLLAMA_HOST=127.0.0.1:11434` systemd drop-in NemoClaw
installs to keep Ollama loopback-only was inlined in the
`install-ollama` branch, so a re-onboard with a pre-existing Ollama
whose override still binds `0.0.0.0:11434` (from older NemoClaw
releases) silently kept Ollama exposed to every reachable network.
The wizard logged a green `✓ Using Ollama on localhost:11434` line
and continued, masking the binding.

Fix:

- Extract the override logic to
  `src/lib/inference/ollama/systemd-loopback.ts`. Sits alongside the
  existing `proxy.ts` / `windows.ts` Ollama helpers and keeps
  `src/lib/onboard.ts` under the `onboard-entrypoint-budget` gate.
- Call the helper from both the `install-ollama` and the existing-
  Ollama branches of the inference selector. The existing-Ollama
  branch repairs the legacy override on re-onboard.
- Idempotency check uses `systemctl show ollama.service
  --property=Environment` (which already merges all drop-ins in
  lexicographic order) rather than reading `override.conf` directly,
  so a later drop-in overriding the binding can no longer be
  mis-classified. Falls back to `override.conf` only when the
  systemctl probe returns empty (some minimal systems restrict it).
- Order in the existing-Ollama branch: helper FIRST, then manual
  `ollama serve` only as the no-systemd / WSL fallback (gated on
  `findReachableOllamaHost()` still failing). The earlier ordering
  caused `systemctl restart ollama` from the helper to fail with
  "Address already in use" because the manual spawn had already
  bound the port.
- Helper preserves the upstream sudo-prompt explanation line that
  landed in NVIDIA#3420 ("Applying an Ollama systemd override... you may
  be prompted for your password").

Tests: six behavior cases in `systemd-loopback.test.ts` cover the WSL
early-return, no-systemd-unit early-return, idempotent already-loopback
path, rewrite+restart on 0.0.0.0 binding, rewrite-failure path, and the
`override.conf` fallback when `systemctl show` is unavailable.

Signed-off-by: latenighthackathon <support@latenighthackathon.com>

## Summary
- Add v0.0.40 release notes and update docs version metadata.
- Document release-prep behavior changes around onboarding, local
inference, policy preset filtering, and config recovery.
- Refresh generated `nemoclaw-user-*` skills from the source docs.

## Source summary
- #3383 -> `docs/about/release-notes.md`, `docs/reference/commands.md`,
`docs/manage-sandboxes/lifecycle.md`: Reflect macOS Docker-driver
OpenShell gateway onboarding and upgrade behavior.
- #3378 -> `docs/about/release-notes.md`: Capture the Docker-driver
gateway TCP readiness fix and clearer startup failures.
- #3338 -> `docs/about/release-notes.md`,
`docs/inference/use-local-inference.md`: Reflect the Ollama auth proxy
token requirement on native API routes.
- #3420 -> `docs/about/release-notes.md`,
`docs/get-started/prerequisites.md`,
`docs/inference/use-local-inference.md`: Document the Linux Ollama
`zstd` preflight and sudo messaging.
- #3417 -> `docs/about/release-notes.md`,
`docs/inference/inference-options.md`,
`docs/inference/use-local-inference.md`: Reflect detected running vLLM
provider selection.
- #3223 -> `docs/about/release-notes.md`, `docs/reference/commands.md`,
`docs/reference/network-policies.md`, `docs/get-started/quickstart.md`:
Document agent-aware policy preset filtering.
- #3385 -> `docs/about/release-notes.md`: Capture the dashboard forward
TCP reachability check.
- #3160 -> `docs/about/release-notes.md`,
`docs/reference/troubleshooting.md`: Document empty `openclaw.json`
baseline recovery.
- #3367 -> `docs/about/release-notes.md`: Capture OpenClaw plugin
compatibility metadata.

## Test plan
- [x] `python3 scripts/docs-to-skills.py docs/ .agents/skills/ --prefix
nemoclaw-user`
- [x] `make docs`
- [x] `git diff --check`
- [x] Skip-term scan for `docs/.docs-skip` terms

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

# Release Notes v0.0.40

* **New Features**
* Sandbox configuration recovery when inference changes cause data loss
  * Policy presets now intelligently filter based on agent capabilities
  * Enhanced gateway health checks and upgrade reliability

* **Documentation**
* Improved local inference setup instructions with clearer dependency
requirements
  * Clarified vLLM experimental feature availability and prerequisites
  * Reorganized architecture documentation for enhanced clarity
  * Refined security and hardening guidance

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/NVIDIA/NemoClaw/pull/3427)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->