fix(sandbox): include generate-openclaw-config.py in optimized build context

.agents/skills/nemoclaw-user-manage-policy/SKILL.md

@@ -8,6 +8,10 @@ description: "Reviews and approves blocked agent network requests in the TUI. Us
 
 # Approve or Deny NemoClaw Agent Network Requests
 
+## Gotchas
+
+- Custom preset hosts bypass NemoClaw's review process and can widen sandbox egress to arbitrary destinations.
+
 ## Prerequisites
 
 - A running NemoClaw sandbox.
@@ -307,10 +311,19 @@ Files are processed in lexicographic order.
 Processing stops at the first failure; presets already applied are not rolled back.
 Fix the failing file and re-run the command to continue.
 
-> [!WARNING]
-> Custom preset hosts bypass NemoClaw's review process and can widen sandbox egress to arbitrary destinations.
+> **Warning:** Custom preset hosts bypass NemoClaw's review process and can widen sandbox egress to arbitrary destinations.
 > Review every host in a custom preset before applying it, especially when the file originates outside your team.
 
+### Remove a Custom Preset
+
+Custom presets applied with `--from-file` or `--from-dir` are recorded in the NemoClaw sandbox registry alongside their full YAML content, so they can be removed by name — the original file does not need to be kept on disk:
+
+```console
+$ nemoclaw my-assistant policy-remove my-internal-api --yes
+```
+
+`policy-remove` accepts both built-in and custom preset names. Run `nemoclaw <name> policy-list` to see every preset currently applied to the sandbox.
+
 ## Related Skills
 
 - `nemoclaw-user-reference` — Network Policies (use the `nemoclaw-user-reference` skill) for the full baseline policy reference

src/lib/sandbox-build-context.ts

@@ -85,6 +85,11 @@ function stageOptimizedSandboxBuildContext(
     path.join(rootDir, "scripts", "lib", "sandbox-init.sh"),
     path.join(stagedScriptsDir, "lib", "sandbox-init.sh"),
   );
+  // OpenClaw config generator extracted in #2449
+  fs.copyFileSync(
+    path.join(rootDir, "scripts", "generate-openclaw-config.py"),
+    path.join(stagedScriptsDir, "generate-openclaw-config.py"),
+  );
 
   return { buildCtx, stagedDockerfile };
 }

test/sandbox-build-context.test.ts

@@ -27,6 +27,7 @@ describe("sandbox build context staging", () => {
         ),
       ).toBe(true);
       expect(fs.existsSync(path.join(buildCtx, "scripts", "nemoclaw-start.sh"))).toBe(true);
+      expect(fs.existsSync(path.join(buildCtx, "scripts", "generate-openclaw-config.py"))).toBe(true);
       expect(fs.existsSync(path.join(buildCtx, "scripts", "setup.sh"))).toBe(false);
     } finally {
       fs.rmSync(tmpDir, { recursive: true, force: true });