[macOS][Onboard] Docker GPU patch fails with invalid bind-mount error against managed-startup receipt on Colima #10348

Description

On macOS with Colima as the Docker backend, sandbox creation reaches Ready but the Docker GPU compatibility patch step then fails with an invalid bind-mount error against a managed-startup receipt file in a host temp directory, and onboarding does not finish.

Platform scope: Reproduced on macOS only; other platforms not tested.
Regression: Unknown — earlier versions not tested.
OpenShell issue: No — the Docker GPU patch step is NemoClaw's own managed-startup logic.

Environment

Device:        Apple Silicon Mac (arm64), Colima as the Docker backend
OS:            macOS (Apple Silicon, aarch64) — exact OS version not captured by installer output
Architecture:  arm64
Node.js:       v22.23.1
npm:           10.9.8
Docker:        Not captured by installer preflight output (Docker confirmed running via Colima)
OpenShell CLI: openshell 0.0.106
NemoClaw:      nemoclaw v0.0.114
OpenClaw:      N/A (onboarding did not finish)

Steps to Reproduce

1. On macOS with Colima running as the Docker backend, onboard a sandbox non-interactively with a local Ollama inference provider and GPU/sandbox-GPU auto-detection left at its default (do not pass --no-gpu):

   nemoclaw onboard --fresh --name {sandbox} --non-interactive --yes --yes-i-accept-third-party-software

2. Wait for the sandbox creation step to report the sandbox as Ready.
3. Observe the subsequent Docker GPU compatibility patch step.

Expected Result

Onboarding completes successfully, or if the Docker GPU compatibility path is not applicable on this platform, it is skipped rather than attempted and failed.

Actual Result

The sandbox reaches Ready, but the Docker GPU compatibility patch step then fails with an invalid bind-mount configuration error referencing a managed-startup receipt file in a host temp directory that does not exist at the path Docker expects, and onboarding does not finish. This reproduced identically on two separate fresh onboard attempts on the same host.

Logs

Docker GPU patch failed.
Immutable managed-startup helper could not verify shared-state status: docker: Error response from daemon: invalid mount config for type "bind": bind source path does not exist: {host temp dir}/nemoclaw-managed-startup-receipt-{random}/managed-startup-shared-state-transaction-v1

Docker GPU patch did not complete successfully.
    sandbox_phase=Ready
    patched_container_status=running
    patched_container_running=true
    patched_container_exit_code=0
    patched_container_health=healthy

Escape hatches:
    NEMOCLAW_DOCKER_GPU_PATCH=1  use only the Docker GPU compatibility path.
    NEMOCLAW_DOCKER_GPU_PATCH=0  use native OpenShell GPU injection (ignored on Docker Desktop WSL; Jetson also defaults to the compatibility path).
    NEMOCLAW_SANDBOX_GPU=0      skip GPU passthrough entirely (or rerun with --no-gpu).
The failed sandbox and container state is uncertain. Inspect the diagnostics before removing any container.

Onboarding did not finish.