test(onboard): opt generated sandbox fixtures into required local prebuild #8652

Summary

#8651 merged exact head dd5e324a7de642525b1780183a3461c04b77f5bb as 439b57138cb8930b07d5ec9f48728f58b504f5f1. Its production behavior correctly requires trusted local BuildKit for generated OpenClaw/Hermes sandbox images and fails closed when that required prebuild is disabled.

The merged PR CI and automatic exact-main CI expose one deterministic test-fixture contract gap. Each affected generated-sandbox child fixture runs under test mode without an explicit local-prebuild opt-in. resolveSandboxPrebuildEnabled() therefore returns false, while the generated OpenClaw/Hermes path still sets requiresLocalBuildKit=true and correctly stops with Local BuildKit is required for this generated sandbox image. These fixtures mock the child build boundary and intend to exercise generated sandbox creation, so their spawned environments must explicitly opt into that existing path.

OpenShell upgrade blocker: No

Available for pickup

This task is unassigned, and no implementation branch or PR exists from this manager lane. Contributors should claim or assign the issue before starting so work is not duplicated.

Deterministic evidence

• PR CI run 31324172079 is terminal across all eight CLI shards: shards 1, 2, 3, 5, 7, and 8 fail solely on this fixture mechanism; shards 4 and 6 pass.
• Shard 2 job 93271780525, artifact 9041115857, fails test/onboard-installer-restore-intent.test.ts:195 in the exact existing test non-interactive not-ready sandbox with installer restore intent skips the fresh backup, restores the pre-upgrade backup, and stays exec-usable for a workspace marker (#6114). The child exits 1 after the required-BuildKit error, producing assertion 1 !== 0.
• Automatic exact-main CI/Main run 31324418924 binds merge SHA 439b57138cb8930b07d5ec9f48728f58b504f5f1. All eight CLI shards are terminal: shards 4 and 6 pass, while shards 1, 2, 3, 5, 7, and 8 fail solely on the same missing fixture opt-in.
• Exact-main shard 5 job 93272382813 annotates three parameterized failures at test/onboard-reservation-recreate.test.ts:145; its workspaceEnv lacks the same explicit opt-in.
• The exact mechanism affects six files and 25 existing assertions:
  • test/onboard-extra-provider-reconciliation.test.ts — 1
  • test/onboard-installer-restore-intent.test.ts — 1
  • test/onboard-messaging.test.ts — 7
  • test/onboard-reservation-recreate.test.ts — 3
  • test/onboard-sandbox-build.test.ts — 4
  • test/onboard-sandbox-recreation.test.ts — 9
• A deliberately uncommitted +1/-0 proof added only NEMOCLAW_SANDBOX_PREBUILD: "1" to the installer-restore spawned environment. With no production change, the focused file moved from 1/4 failing to 4/4 passing. The proof was not committed.

Proven minimal direction

• Before implementation, inspect the completed exact-main annotations once for any additional occurrence of this exact error and fixture-env mechanism.
• Deduplicate the six confirmed spawned environment sites and opt them into the existing required local-prebuild path with fixture-owned NEMOCLAW_SANDBOX_PREBUILD=1.
• Choose the smallest clear mechanism: direct environment entries or an existing natural fixture helper. Do not add an uncounted helper to hide complexity.
• Preserve all 25 existing assertions; add no new test or source-shape case.

Acceptance criteria

• All six listed focused files pass all 25 existing assertions with the explicit local-prebuild contract.
• Full eight-shard CLI CI passes on the exact repair commit.
• Existing focused sandbox-prebuild, sandbox-create-launch, and supported Linux non-WSL Docker/Buildx coverage remains green and fail-closed.
• Production behavior, resolveSandboxPrebuildEnabled(), and requiresLocalBuildKit enforcement are unchanged.
• No new tests, cases, source-shape cases, or conditions are introduced; changed-test conditional growth remains 0→0.
• No fallback, bypass, skip, global test-mode override, or ci/source-shape-test-budget.json edit is introduced.
• Source-shape, test-size, test-title, project-membership, diff, budget, lockfile, formatting, CLI typecheck, normal repository, and independent review gates pass.
• No production, dependency, lockfile, or package-manifest change is introduced.

Explicit exclusions

• Separate EXDEV derived-managed product gap.
• Portable Profile.
• Latency or readiness signals.
• Rebuild or image-GC work.
• Gateway, websocket, or shields clusters.
• Documentation or error-text nits.
• Bootstrap, feat(qualification): enforce OpenShell v0.0.101 receipts #8635, chore(openshell): trust v0.0.101 release identities #8616, docs(security): review OpenShell v0.0.101 contracts #8617, or candidate work.
• Broader onboarding or test-topology cleanup, new tests/cases/conditionals, manual E2E, workflow dispatch, or release action.