[DGX Spark][Sandbox] failed Hermes rebuild reports a false identity mismatch and omits recovery guidance

Description

On DGX Spark, a Hermes sandbox rebuild that loses its sandbox container during the post-restore gateway restart exits nonzero, but the final diagnostic says that the replacement agent version did not match even though the command reported the same current and target Hermes version. The output also omits the actionable gateway restart and recovery commands described by the public Hermes recovery documentation.

Platform scope: Reproduced on DGX Spark only; other platforms not tested

Regression: Unknown — earlier versions not tested

OpenShell issue: No

Environment

Device:        DGX Spark
OS:            Linux (distribution and kernel version not captured)
Architecture:  aarch64
Node.js:       v22.22.3
npm:           10.9.8
Docker:        28.3.3
OpenShell CLI: 0.0.116
NemoClaw:      v0.0.126
OpenClaw:      N/A (Hermes Agent v0.20.6)

Steps to Reproduce

1. Install NemoClaw v0.0.126 on a DGX Spark and onboard a Hermes sandbox named hermes-rebuild-test.
2. Run nemohermes hermes-rebuild-test rebuild --yes.
3. Confirm that the ordinary rebuild completes and the Hermes gateway is healthy.
4. Start the same rebuild command again.
5. When the command prints Restoring workspace state..., stop the one running container labeled openshell.ai/sandbox-name=hermes-rebuild-test to simulate a post-restore supervisor failure.
6. Observe the final rebuild diagnostic and exit status.

Expected Result

The rebuild should exit nonzero and identify that the sandbox replacement and state restore completed but post-restore gateway verification did not. It should direct the operator to run nemohermes hermes-rebuild-test gateway restart first and nemohermes hermes-rebuild-test recover if verified health is not restored, consistent with the public Hermes recovery guidance.

Actual Result

The rebuild exits with status 1 after reporting the gateway restart failure. It then reports an agent-version mismatch even though Current and Target were both Hermes Agent v0.20.6, and it does not print the gateway restart or recover commands.

Logs

Current:  Hermes Agent v0.20.6
Target:   Hermes Agent v0.20.6
Restoring workspace state...
Failure layer: launch failure - gateway restart failed for 'hermes-rebuild-test'.
Replacement agent version did not match the rebuild target (expected 0.20.6, observed unverified).
Replacement agent version did not match the authoritative rebuild target.