fix(portable): reject mismatched resume socket authority before host effects

[senthilr-nv]

Parent: #9006

Problem

PR #9074 implemented #9035 from commit 52d026093f15dcb75b82c65f61f5ba01c8e63e4e and merged as 0a8a6d07e1cb36c31b975fa838d6a3deb50fd51f.

The post-merge review found one remaining admission-order defect: discussion r3780780744.

A valid schema-4 portable checkpoint can record a socket path that is a different missing descendant of the canonical current-user runtime directory. Portable preparation accepts ENOENT for that stored path, writes three NemoClaw-owned configuration files, and runs these commands:

• systemctl --user set-environment
• systemctl --user try-restart podman.service
• systemctl --user enable --now podman.socket

NemoClaw then discovers the live Podman socket and rejects the endpoint mismatch. These effects occur before rejection, contrary to #9035's requirement that authority drift fail before writes.

Required behavior

Resume admission must reject a noncanonical or mismatched recorded socket authority before configuration writes, user-systemd mutations, Podman or Docker-compatible runtime calls, OpenShell calls, or registry reconciliation.

A canonical checkpoint socket that is absent because the user service stopped or the host rebooted remains a supported case. The implementation must distinguish that state from a mismatched endpoint and from generic qualification failure. It must preserve bounded activation and exact requalification of the canonical current-user socket.

Acceptance criteria

• A valid schema-4 portable checkpoint with a different missing socket descendant fails before any NemoClaw configuration write.
• The same mismatch fails before any systemctl --user call.
• The mismatch fails before Podman, Docker-compatible, OpenShell, or managed-registry work.
• Tests assert zero configuration and systemd effects for noncanonical or mismatched recorded endpoint authority.
• The implementation defines the minimal effects permitted only for a canonical-but-cold socket.
• A canonical-but-cold socket can activate after reboot and must requalify at the exact recorded path for the effective user.
• Generic qualification failure cannot enter the canonical cold-socket recovery path or cause unapproved remediation effects.
• Unsafe, symlinked, wrong-owner, substituted, or unreachable authority remains fail-closed.
• Fresh onboarding, default-profile resume, and non-portable behavior remain unchanged.

Scope boundaries

• This issue owns fail-before-writes admission for noncanonical or mismatched checkpoint socket authority.
• Use native Podman lifecycle operations for portable sandbox recovery #9068 owns native Podman sandbox lifecycle recovery. Do not add that work here.
• fix(portable): separate Podman socket activation readiness from steady-state health #9070 owns activation-versus-steady-state readiness. Coordinate the canonical cold-socket boundary without absorbing that work.
• Do not weaken canonical reboot recovery to make mismatch tests pass.
• Do not add Docker or ambient-runtime fallback.

Live evidence limitation

The #9035 live lane was a PARTIAL PASS / BLOCKED DOWNSTREAM BY #9068. It proved resume-authority reconstruction and socket requalification from an active schema-4 checkpoint with a pre-existing Ready sandbox. It did not reach the policy boundary, 8/8 completion, chat, completed-resume, or full Brev acceptance.

Checklist

• Searched open and closed issues; no exact issue owns this defect.
• Linked the merged implementation, review finding, and parent issue.
• Add deterministic negative tests before implementation.