test(hermes): tighten stale verifier allowlist

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Author: ericksoa

scripts/verify-hermes-stale-openclaw-image.sh

@@ -52,9 +52,6 @@ require_safe_image_ref() {
   if [[ "$ref" == ghcr.io/nvidia/nemoclaw/hermes-sandbox-base* ]]; then
     fail "Hermes base image ref is not an allowed Hermes base form: $ref"
   fi
-  if [[ ! "$ref" =~ ^[A-Za-z0-9][A-Za-z0-9._/-]*([:@][A-Za-z0-9._:-]+)?$ ]]; then
-    fail "Hermes base image ref is not a supported Docker reference: $ref"
-  fi
   fail "Hermes base image ref is outside the allowed Hermes base images: $ref"
 }
 

test/hermes-stale-openclaw-guard.test.ts

@@ -78,7 +78,7 @@ describe("Hermes stale OpenClaw guardrails", () => {
     fs.mkdirSync(fakeBin);
     fs.writeFileSync(
       path.join(fakeBin, "docker"),
-      "#!/usr/bin/env bash\nprintf 'docker %s\\n' \"$*\" >> \"$NEMOCLAW_FAKE_DOCKER_LOG\"\nexit 99\n",
+      '#!/usr/bin/env bash\nprintf \'docker %s\\n\' "$*" >> "$NEMOCLAW_FAKE_DOCKER_LOG"\nexit 99\n',
       { mode: 0o700 },
     );