docs(security): review OpenShell v0.0.101 contracts - #8617

<!-- markdownlint-disable MD041 -->
## Summary

Restore the required root-owned, immutable `0444` mode for the reviewed
managed-startup runtime bundle in every managed agent image. The repair
uses each final image's existing permission replay so legacy builders
remain supported and promotion continues to fail closed.

This repair blocks clean trusted main and therefore blocks publication
of the draft-only trust-root bootstrap. It does not directly qualify
#8616 or #8617.

## Changes

- Require the managed-startup runtime bundle to be a regular, non-link
file in the OpenClaw, Hermes, and Deep Agents Code final images.
- Replay `root:root` ownership and mode `0444`, then require the final
numeric stat to be `0:0:444`.
- Preserve the reviewed bundle bytes, original builder-stage copy
provenance, legacy-builder compatibility, six-variant validation, and
aggregate promotion barrier.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [ ] Tests added or updated for changed behavior
- [x] Existing tests cover changed behavior — justification: The
supported managed-image workflow validator checks regular-file,
non-link, and `0:0:444` invariants for all six agent/architecture
candidates before aggregate promotion. Focused image-layout and workflow
contracts passed for this commit.
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: This restores an existing
internal image artifact invariant and changes no command, configuration,
default, documented workflow, or supported surface.
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: Fresh independent
correctness/security review of commit
`591550ad54cc43b7b18982712b16d40902f41a29` passed all nine security
categories with no findings.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Documentation Writer Review

- [x] Documentation writer subagent reviewed the completed changes
- Result: `no-docs-needed`
- Evidence: Commit 591550a restores the existing root-owned, read-only
managed-image runtime artifact contract in three Dockerfiles. It changes
no command, configuration, default, documented workflow, or supported
surface.
- Agent: Codex Desktop
<!-- docs-review-head-sha: 591550a -->
<!-- docs-review-agents-blob-sha: c4923a3 -->

## DGX Station Hardware Evidence

- [ ] Tested on DGX Station
- Tested commit:
- Station profile/scenario:
- Result:
- Supporting evidence:

## Verification

- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run validate:pr` passed after refreshing `origin/main` when hooks
were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — `47` focused image/layout/workflow
tests passed; the targeted Deep Agents Code compatibility contract
passed.
- [ ] Applicable broad gate passed — Not applicable to this
three-Dockerfile permission repair; `npm run checks:repository`,
Dockerfile lint, reviewed-bundle verification, and the source-shape
audit passed.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

Final resolution still requires the first automatic exact-main
managed-image run after external merge to pass all six validation jobs
and artifact receipts. No manual E2E run was dispatched.

---
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Strengthened container image validation to ensure the managed startup
runtime is present as a regular, non-symlink file.
* Confirmed the runtime file is root-owned and has read-only permissions
before startup checks complete.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>