## Summary
- Follow-up to #2227: keep `/sandbox/.bashrc` and `/sandbox/.profile` as
static source shims instead of rewriting them at startup.
- Generate gateway token export and the NemoClaw configure guard into
`/tmp/nemoclaw-proxy-env.sh` via the existing trusted
`emit_sandbox_sourced_file` path.
- Make the base image create shell startup files as `root:root` mode
`444`, and update docs/tests for the new default behavior.

## Validation
- `npm test -- test/nemoclaw-start.test.ts test/service-env.test.ts
test/sandbox-provisioning.test.ts test/sandbox-init.test.ts`
- `NEMOCLAW_TEST_IMAGE=nemoclaw-override-test-d7ea5b15 bash
test/e2e/test-runtime-overrides.sh`

## Notes
- This targets the raw `docker run` runtime-overrides failure where root
had already dropped `CAP_DAC_OVERRIDE` and could no longer create
`/sandbox/.bashrc` temp files.
- The OpenClaw default `$HOME/.openclaw` mutable state behavior from
#2227 remains unchanged.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Hardened sandbox shell startup by making user RC files root-owned and
read-only, and moving runtime token/export handling to a generated
runtime env script that is sourced via a static shim.

* **Documentation**
* Updated security best-practices to describe the new runtime env script
flow and revised default locked-down posture wording.

* **Tests**
* Adjusted and added tests to validate the runtime env emission, shim
backfill, and immutable RC file expectations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->