[Pi 3/7] Integrate Pi onboarding, lifecycle, state, and recovery

[prekshivyas]

Summary

Integrate Pi with the public, compute-runtime-neutral NemoClaw sandbox lifecycle.

Parent epic: #7923

Coordination epic: #7744

Depends on #7926 and #7925.

Problem Statement

Users cannot select Pi during onboarding. NemoClaw cannot persist or operate Pi as a known sandbox agent.

Without lifecycle integration, status, recovery, rebuild, backup, upgrade, and destroy behavior remain undefined.

A Pi-specific Docker or Podman path would duplicate lifecycle behavior and conflict with #7744's driver-neutral contracts.

Desired Behavior

Interactive onboarding and nemoclaw onboard --agent pi select the Pi agent. NemoClaw records the selection in the sandbox registry.

Stock onboarding selects the exact managed-image digest from #7925. It does not build a repository Dockerfile on the user's host.

Inventory and lifecycle commands identify the agent runtime as Pi. Each command delegates compute-runtime behavior through the selected provider bundle.

Scope

• Agent discovery and interactive selection.
• Non-interactive onboarding input.
• Managed-image workload selection.
• Sandbox registry persistence for agent and compute-runtime identities.
• Connection and Pi terminal entry.
• Inventory, status, logs, and diagnostics.
• Rebuild, backup, restore, upgrade, and destroy behavior.
• Resume and failed-onboarding recovery.
• Pi-specific actionable errors.

Constraints and Non-goals

• Do not infer Pi for sandboxes that have no recorded agent identity.
• Do not infer compute-runtime identity from the Pi agent identity.
• Do not preserve state outside the accepted manifest.
• Do not add a Pi-specific Docker, Podman, gateway, lifecycle, snapshot, or recovery branch.
• Do not import Pi code into a compute-runtime provider.
• Do not depend on the current feat(runtime): add native Podman support for all agents #7872 draft architecture.
• Do not add messaging channels or a dashboard unless the product decision includes them.
• Do not change other agents' lifecycle contracts.

Acceptance Criteria

• Interactive and non-interactive onboarding select and persist pi.
• Stock onboarding selects an exact Pi managed-image digest without a host build.
• A fresh onboarding starts Pi through a documented public command.
• Inventory, status, logs, and diagnostics identify Pi separately from the compute runtime.
• Resume recovers a failed Pi onboarding without changing the selected agent or compute runtime.
• Rebuild and upgrade restore the accepted runtime, managed-image identity, and state.
• Backup and restore include only declared persistent state.
• Destroy delegates cleanup to the selected compute-runtime provider.
• Pi lifecycle code contains no Docker or Podman identity comparison.
• Unsupported agents or compute runtimes report actionable errors.
• Tests inject a non-Docker provider without changing Pi behavior.
• Tests cover fresh onboarding, resume, rebuild, backup, upgrade, and destroy behavior.

Category

Feature

Checklist

• I searched existing issues and this is not a duplicate.
• I described the problem and desired behavior.