…ontext (#4970)

## Summary

Nightly E2E run
[27154074940](https://github.com/NVIDIA/NemoClaw/actions/runs/27154074940)
lost **48 of 67 jobs** to a single root cause: every E2E job that
exercises onboard/install died at the same Dockerfile step with

```
COPY failed: file not found in build context: stat
scripts/patch-openclaw-slack-deny-feedback.mts: file does not exist
```

PR #4933 added `scripts/patch-openclaw-slack-deny-feedback.mts` and the
matching `COPY` line in `Dockerfile`, but did **not** register the new
file in `stageOptimizedSandboxBuildContext`
(`src/lib/sandbox/build-context.ts`). The optimized staging path
hand-copies a curated set of files into a temp build context — its two
existing siblings (`patch-openclaw-tool-catalog.js`,
`patch-openclaw-chat-send.js`) are listed there explicitly. The new
`.mts` patch was missed, so `docker build` couldn't see it.

PR #4933 itself was green because PR-time builds were satisfied by other
paths or cached layers; the gap only showed up when nightly built from
main against the staged context.

## Change

- `src/lib/sandbox/build-context.ts`: stage
`patch-openclaw-slack-deny-feedback.mts` next to its siblings.
- `test/sandbox-build-context.test.ts`: extend the fixture + assertion
so any future drop of this file is caught locally before it can take
down nightly.
- `test/sandbox-build-context.test.ts`: parse staged Dockerfile `COPY
scripts/...` lines and verify every referenced script exists in the
optimized staged context, folding in the broader guard from #4971.

## Validation

- `npx vitest run test/sandbox-build-context.test.ts` → 7/7 passing
locally.
- GitHub PR checks on updated head `7fca86f78` are green, including
`build-sandbox-images`, `build-sandbox-images-arm64`,
`unit-vitest-linux`, `cli-tests`, and downstream self-hosted smoke jobs.
- After merge, rerun `nightly-e2e.yaml` (or `gh run rerun 27154074940
--failed`). A single onboard-stage job clearing Dockerfile step 23
confirms all 48 failures are resolved.

## Follow-up (suggested, not in this PR)

The two-place duplication (`Dockerfile` `COPY` + hand-listed staging) is
the structural cause of this incident. This PR now adds a contract test
for that duplication; a future cleanup could still drive the staged list
from a glob (`scripts/patch-openclaw-*.{js,mts}`) or shared manifest.

cc @yimoj (PR #4933 author).

---------

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Co-authored-by: Carlos Villela <cvillela@nvidia.com>

## Summary
- Add the v0.0.61 release notes from the GitHub dev announcement.
- Document managed vLLM recovery after host reboot and Slack
denied-mention feedback.
- Refresh generated `nemoclaw-user-*` skills from the source docs.

## Source summary
- #4983 -> `docs/about/release-notes.mdx`: Added the v0.0.61 release
summary from the dev announcement and linked behavior groups to deeper
docs.
- #4904 -> `docs/inference/use-local-inference.mdx`: Documented that
managed vLLM restarts the `nemoclaw-vllm` container after host reboot
during recovery.
- #4933 -> `docs/manage-sandboxes/messaging-channels.mdx`: Documented
Slack sender feedback for denied channel `@mention` events.
- #4879, #4915, #4935, #4759, #4164, #4888, #4897, #4944, #4959 ->
`.agents/skills/`: Refreshed generated user skills from the current
source docs for release prep.

## Verification
- `python3 scripts/docs-to-skills.py docs/ .agents/skills/ --prefix
nemoclaw-user --doc-platform fern-mdx`
- `npm run docs` (passed outside the tool sandbox after `tsx` IPC pipe
creation was blocked in the sandbox)
- `npm run build:cli` (refreshed local `dist/` for the pre-push
TypeScript hook)
- Commit and pre-push hooks passed, including docs-to-skills
verification, markdownlint, gitleaks, skills YAML tests, and CLI
TypeScript.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
  * Updated sandbox security documentation with file descriptor limits.
  * Changed default inference model for DGX Station profile.
  * Enhanced agent policy and backup/restore documentation.
  * Improved command reference examples with clearer formatting.
  * Clarified Slack messaging denial notice behavior.
  * Added automatic vLLM container recovery during host reboot.
  * Updated release notes for v0.0.61.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->