## Summary
- Add v0.0.64 release notes from the release announcement and link them
to the relevant deeper docs.
- Document that custom policy presets recorded through `policy-add
--from-file` and `--from-dir` survive snapshot restore and sandbox
recreation.
- Refresh generated NemoClaw user skills from the current source docs.

## Source summary
- #5104 -> `docs/manage-sandboxes/backup-restore.mdx`,
`docs/network-policy/customize-network-policy.mdx`: Documents custom
policy presets preserved through snapshot restore.
- #4955 -> `docs/about/release-notes.mdx`: Adds release-note coverage
for Brave web-search pinning and `BRAVE_API_KEY` placeholder
preservation.
- #5116, #5269 -> `docs/about/release-notes.mdx`: Adds release-note
coverage for Docker-driver gateway health and rootfs guard stability.
- #5241, #5085 -> `docs/about/release-notes.mdx`: Adds release-note
coverage for chat-completions provider selection and Nemotron Ultra 550B
tool-less request compatibility.
- #5268, #5210, #5257 -> `docs/about/release-notes.mdx`: Adds
release-note coverage for messaging render plan refresh, OpenClaw
scope-upgrade approval recovery, and Hermes WhatsApp bridge dependency
setup.
- Current source docs -> `.agents/skills/`: Regenerates user-skill
references so agent-facing guidance matches the source documentation.

## Verification
- `python3 scripts/docs-to-skills.py docs/ .agents/skills/ --prefix
nemoclaw-user --doc-platform fern-mdx`
- `npm run docs`
- `npm run build:cli`
- `npm run typecheck:cli`
- Commit/pre-push hooks: markdownlint, gitleaks, docs-to-skills
verification, TypeScript CLI, and skills YAML checks passed.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Clarified sandbox snapshot restore preserves custom policy presets and
restores them without original files.
* Switched sandbox setup and remote deployment guidance to Docker-based
workflows and emphasized remote onboarding flow.
* Expanded troubleshooting for gateway recovery, Docker GPU/WSL issues,
and onboarding resume.
* Added/updated CLI docs: advanced maintenance, session export,
upload/download wrappers, and status recovery guidance.
* Added v0.0.64 release notes and links to NemoClaw Community; fixed
command reference formatting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

…tall validates (#5318)

## Summary

Enabling Brave Web Search at onboarding still aborts the sandbox image
build at the OpenClaw plugin-install step.
`scripts/generate-openclaw-config.mts` writes the legacy
`tools.web.search` shape (inline `apiKey`), which OpenClaw 2026.5.x
rejects — and because `openclaw plugins install` validates the existing
config *before* installing, it exits non-zero while the brave plugin is
not yet installed, aborting the build under `set -eu` before `openclaw
doctor --fix` can migrate it. This PR emits the current schema directly
so the build-time install validates cleanly.

## Related Issue

Fixes #5266 (follow-up to #4955 / #3948)

## Changes

- `scripts/generate-openclaw-config.mts`: when
`NEMOCLAW_WEB_SEARCH_ENABLED=1`, write `tools.web.search = { enabled,
provider: "brave" }` and move the provider-owned `apiKey` placeholder to
`plugins.entries.brave.config.webSearch` — the same shape `doctor --fix`
produces after a successful install.
- `test/generate-openclaw-config.test.ts`: update the existing
web-search case to assert the current schema (no inline `apiKey`) and
the `plugins.entries.brave` entry.

## Why this is the fix

`#4955` pinned/installed `@openclaw/brave-plugin` at build time and
threaded `BRAVE_API_KEY` into the doctor env, assuming `doctor --fix`
would migrate the legacy block. But `plugins install` runs config
validation up front, so on the legacy shape it fails (exit 1) before the
plugin exists — an ordering deadlock the migration step never gets to
resolve.

Verified inside `ghcr.io/nvidia/nemoclaw/sandbox-base:v0.0.55` (OpenClaw
2026.5.27):

```
legacy schema (inline apiKey)         → openclaw plugins install EXIT=1   # current behavior, breaks build
current schema (plugins.entries.brave) → openclaw plugins install EXIT=0  # this PR
```

End-to-end: a real `nemoclaw onboard --recreate-sandbox` with Brave Web
Search **and** Slack both enabled now builds cleanly, and `web_search`
works in the running sandbox alongside Slack.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)

## Verification

- [x] Tests added or updated for new or changed behavior
- [x] No secrets, API keys, or credentials committed
- [x] `test/generate-openclaw-config.test.ts` passes (128/128) — covers
the changed code
- [x] `npm run typecheck:cli` passes; `npx biome lint` clean on changed
files
- [ ] Full `npm test` — relevant subset verified; the full local run had
unrelated timeouts under heavy parallelism (spawn/docker suites), none
in the changed files. Deferring to CI for the authoritative full run.

---
Signed-off-by: Zhi Yan Liu <lzy.dev@gmail.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Web-search config updated to the new OpenClaw schema: provider-only
tools entry and Brave API key moved into plugin config; CI test-size
budget adjusted.

* **Tests**
* Updated tests to assert the new schema and added coverage to accept
legacy inline API-key placements.

* **Bug Fixes**
* Web-search verification now resolves and validates the Brave API key
from both new plugin config and legacy inline locations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Zhi Yan Liu <lzy.dev@gmail.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Co-authored-by: Carlos Villela <cvillela@nvidia.com>