## Summary
- repair stale sandbox `inference.local` DNS proxy routes during
connect/probe when the sandbox has a persisted inference provider/model
- prefer the stable kube-dns service IP for the sandbox DNS proxy, with
CoreDNS endpoint fallback
- route `nemohermes uninstall` as a global uninstall command
- omit the Brave policy preset when the selected sandbox image does not
support NemoClaw's Brave web-search path, while preserving OpenClaw
behavior and sandbox custom presets with colliding names
- document `NEMOCLAW_DISABLE_INFERENCE_ROUTE_REPAIR` as the
troubleshooting escape hatch for automatic DNS-proxy repair

## Validation
- `npm run build:cli`
- `npm run typecheck:cli`
- `npx vitest run test/policy-tiers-onboard.test.ts
test/onboard-preset-diff.test.ts`
- `npx vitest run test/onboard.test.ts -t
"computeSetupPresetSuggestions|agentSupportsWebSearch|configureWebSearch|prints
numbered step headers"`
- `npx vitest run test/sandbox-connect-inference.test.ts
src/lib/actions/dns/index.test.ts test/nemohermes-alias.test.ts
test/uninstall.test.ts
src/lib/actions/sandbox/oclif-command-adapters.test.ts
src/lib/commands/simple-global-oclif-adapters.test.ts`
- `git diff --check`