…4423) (#5091)

## Summary

Closes the active-recovery half of #4423 — parts 2 & 3 of @ericksoa's
plan. The destructive registry-removal paths were already neutralized
by:

- **#4578** — `status` no longer calls `registry.removeSandbox` on
`NotFound` unless the gateway is `healthy_named`.
- **#4497** — `ensureLiveSandboxOrExit` (which `connect` rides)
preserves the registry entry on `missing` and routes intentional purges
through explicit `destroy`.

What's still missing is the *active recovery* path: when the gateway
returns to `healthy_named` after a reboot but reports the sandbox as
`NotFound`, NemoClaw currently prints "retry in a moment" guidance. This
PR makes it walk Docker by the OpenShell labels, restart the labeled
container (or rename a `*-nemoclaw-gpu-backup-*` sibling back), re-query
OpenShell, and return a `present` lookup with a recovery breadcrumb. The
user runs `nemoclaw <name> status` once and the sandbox is live.

## Related Issue

Refs #4423

## Changes

### New: `src/lib/onboard/docker-driver-sandbox-recovery.ts`

`recoverDockerDriverSandbox(name, deps)` scans Docker by
`openshell.ai/managed-by=openshell` AND
`openshell.ai/sandbox-name=<name>` (the same labels
`findOpenShellDockerSandboxContainerIds` already uses). Dispatches by
container shape:

| Branch ID | Trigger | Action |
|---|---|---|
| `started-running-original` | Labeled container is already running |
No-op success |
| `started-stopped-original` | Labeled container exists but stopped |
`docker start` |
| `renamed-and-started-backup` | Only a `*-nemoclaw-gpu-backup-*`
sibling exists (from `docker-gpu-patch.ts`'s GPU patch) | `docker rename
<backup> <original>` then `docker start` |
| Conflict | Stopped original + backup sibling both exist | Start the
original, leave the backup alone |
| None | No labeled container | `{ recovered: false }` — callers fall
through to existing non-destructive guidance |

Adapter access is per-call lazy `require` — top-level `import` from
`../adapters/docker` pulls in `runner.ts`'s load-time
`require("./platform")` which the Vitest TS loader can't resolve. Same
escape hatch as `auto-pair-approval.ts`.

Label constants are duplicated locally with comments pointing to
`docker-gpu-patch.ts` as the source of truth.

### Wiring: `src/lib/actions/sandbox/gateway-state.ts`

`reconcileMissingAgainstNamedGateway` now calls the helper:
- After the existing `gateway select nemoclaw` retry path lands on
`healthy_named` + `missing`.
- On the new top-level `healthy_named` + `missing` precondition that
#4423's bug class describes (gateway came back fresh after reboot with
no sandbox memory).

`SandboxGatewayState` gains `recoveredSandbox?: boolean` and
`recoverySandboxVia?: string | null` so callers can render a recovery
breadcrumb without re-walking the recovery chain.

### User-facing breadcrumb: `src/lib/actions/sandbox/status.ts`

Present-state output now prints:

```
Recovered sandbox '<name>' from Docker via <branch>; OpenShell now sees it as live.
```

before the canonical OpenShell sandbox info.

## Test results

- ✅ **12 new helper tests** in `docker-driver-sandbox-recovery.test.ts`
(all 4 dispatch branches, rename/start failure surfaces,
no-labeled-container empty case).
- ✅ **Existing 30 reconcile tests** in
`gateway-state-reconcile-2276.test.ts` and `gateway-state-drift.test.ts`
still pass — the new branch is additive and only fires under
`healthy_named` + `missing` which existing tests don't exercise.
- ✅ **1621 tests across `src/lib/onboard/`, `src/lib/actions/sandbox/`,
`test/gateway-state*.test.ts`** all green.

## Verification surface

- The post-reboot recovery scenario from #5087
(`ubuntu-repo-docker-post-reboot-recovery`) continues to go 🟢 GREEN —
its host-side invariants (`local-registry-entry-present`,
`docker-sandbox-container-present`) are exactly what this fix preserves.
- A future controlled-runner scenario can extend
`post-reboot-recovery-ready` with gateway/sandbox runtime probes once a
real-reboot environment is wired.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Verification

- [x] `npx prek run --all-files` passes
- [x] `npm test` passes — 1621 affected tests green; full suite to be
exercised by CI on this branch.
- [x] Tests added or updated for new or changed behavior.
- [x] No secrets, API keys, or credentials committed.
- [x] Live `ubuntu-repo-docker-post-reboot-recovery` scenario stays
green; will dispatch on this branch as a post-push verification step.

## Boundaries kept honest

- The helper talks to Docker only. OpenShell re-query is the caller's
job.
- Profile dispatch is exhaustive (`never`-checked); adding a new branch
requires extending both the helper switch and the unit test.
- Recovery is best-effort and short-circuits to `{ recovered: false }`
on any failure, so callers' existing non-destructive guidance stays the
safety net.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Sandboxes marked as missing after a system reboot can now be
automatically recovered from Docker if the container still exists on
disk.
* Status messages now display recovery information when a sandbox is
restored.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Carlos Villela <cvillela@nvidia.com>