Add read-only host bind mounts to onboarding #8274

Problem

NemoClaw cannot declare an existing host directory as a read-only sandbox path during onboarding. nemoclaw <name> upload creates a copy, and nemoclaw <name> share mount projects sandbox files onto the host through bidirectional SSHFS. Neither command gives an agent a live, read-only view of an existing host directory.

OpenShell now supports gated Docker and Podman bind mounts through --driver-config-json. Bind mounts are read-only by default and require enable_bind_mounts = true in the selected driver configuration.

Follow-up to #1045. The original NemoClaw attempt in #1189 closed without merging. The SSHFS alternative shipped in #2773.

Accepted scope

Add a NemoClaw onboarding option for one or more read-only host bind mounts on the NemoClaw-managed Docker driver.

Example:

nemoclaw onboard \
  --host-mount /home/user/project:/sandbox/project

The first implementation must not expose read-write host mounts.

Required behavior

• Accept repeated --host-mount <host-path>:<sandbox-path> values.
• Require an existing absolute host directory with no symbolic-link path component.
• Require an absolute normalized sandbox path below /sandbox.
• Reject duplicate host paths and duplicate sandbox targets.
• Pass each mount to OpenShell as a Docker bind mount with read_only: true.
• Enable bind mounts only for the NemoClaw-managed Docker gateway configuration used for this onboarding request.
• Preserve the declaration for sandbox rebuilds and reject lifecycle operations that cannot reproduce the mount.
• Report the host exposure before sandbox creation.
• Document the sandbox-boundary reduction and the difference from upload and share mount.

Validation

• Unit tests cover parsing, path validation, duplicate rejection, and OpenShell argument generation.
• Integration coverage verifies the managed gateway opt-in and read-only driver configuration.
• Documentation build passes.

Upstream capability

• feat(drivers): support docker and podman config mounts OpenShell#1785 added gated Docker and Podman driver-config mounts.
• feat(docker,podman): add SELinux label support for bind mounts OpenShell#2092 added SELinux label support for bind mounts.