Summary

Stock managed-runtime activation accepted Hermes Portable because the decision input only carried the OpenClaw portable lifecycle flag. This PR carries the Hermes Portable lifecycle into that decision, preserving the shipped Hermes Dockerfile path while leaving normal shipped-agent managed activation and the fail-closed guard unchanged. The activation unit test now covers the separate Hermes Portable flag that prior coverage omitted.

Related Issue

Fixes #9634

Stacked on #9323. Supports #9140.

Changes

• Pass the Hermes Portable lifecycle selection into the stock managed-runtime activation decision.
• Exclude OpenClaw Portable and Hermes Portable while retaining managed activation for shipped non-Portable agents.
• Add focused regression coverage for Hermes Portable activation selection.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable
• Station profile/scenario: Not applicable
• Result: Not applicable
• Supporting evidence: Not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project cli src/lib/onboard/managed-workload/onboard-orchestration.test.ts (8 passed); npx vitest run --project cli src/lib/onboard/sandbox-gpu-create-flow-hermes-portable.test.ts (8 passed)
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Aaron Erickson aerickson@nvidia.com