fix(nemoclaw): remove USER sandbox two-stage build workaround

[LinoyBitan1]

Summary

Remove the chained BuildConfig workaround that added USER sandbox and chown -R sandbox:sandbox /sandbox to the nemoclaw-sandbox image build.
The upstream fix (NemoClaw #7882 / NemoClaw #7890) has shipped in ghcr.io/nvidia/nemoclaw/sandbox-base:latest - the base image now defaults to USER sandbox with correct file ownership.

Jira: APPENG-5963

Background

NemoClaw's upstream Dockerfile previously defaulted to USER root at the end of the build, which caused OpenShift to reject the container (non-root UID enforcement). We implemented a two-stage chained BuildConfig as a workaround:

1. nemoclaw-sandbox-root — builds from the upstream NemoClaw Dockerfile as-is (ends with USER root)
2. nemoclaw-sandbox — layers chown -R sandbox:sandbox /sandbox + USER sandbox on top

With the upstream fix shipped, this workaround is no longer needed.

Changes

• nemoclaw-imagestream/templates/buildconfig.yaml — collapsed two BuildConfigs into one. Removed the -root ImageStream, the chained FROM nemoclaw -sandbox-root:latest stage, and the RUN chown / USER sandbox layer. Added TARGETARCH build arg.
• nemoclaw-imagestream/values.yaml — updated NemoClaw git ref from 15069f9 to 588bb6d (the old ref pointed to a Dockerfile that ended with USER root; the new ref includes the merged upstream fix #7890 that ends with USER sandbox). Added targetArch: "amd64" because the NemoClaw Dockerfile uses ARG TARGETARCH to compile platform-specific binaries — Docker multi-platform builds set this automatically, but OpenShift's BuildConfig does not, so it must be passed explicitly.
• nemoclaw-cli-imagestream/values.yaml — updated NemoClaw git ref to the same 588bb6d commit to keep CLI and sandbox building from the same source.
• Makefile-quickstart — removed nemoclaw-sandbox-root from ImageStream cleanup and removed the oc start-build nemoclaw-sandbox-root step. Only one build to trigger now.

Verification

• Upstream base image has USER sandbox as default
• make build-nemoclaw — single BuildConfig builds successfully
• No Permission denied errors on sandbox create
• Sandbox runs correctly — openshell sandbox create succeeds
• TUI works — openclaw gateway starts, responds to prompts

[LinoyBitan1]

@mtalvi Rebased on main, rebuilt, and retested successfully

[mtalvi]

LGTM!