fix(images): require trusted base image overrides

docs/reference/commands.mdx

@@ -3595,14 +3595,16 @@ Local bases are accepted only when NemoClaw builds and pins them during the curr
 <AgentOnly variant="deepagents">
 
 Set `NEMOCLAW_LANGCHAIN_DEEPAGENTS_CODE_SANDBOX_BASE_IMAGE_REF` to a LangChain Deep Agents Code sandbox-base tag or digest to override base-image resolution during onboarding.
-NemoClaw requires environment overrides to use the official remote repository and resolve to an immutable repository digest, then validates the requested image against the manifest-required `deepagents-code` package version before using it. Local bases are accepted only when NemoClaw builds and pins them during the current operation.
+NemoClaw requires environment overrides to use the official remote repository and resolve to an immutable repository digest, then validates the requested image against the manifest-required `deepagents-code` package version before using it.
+Local bases are accepted only when NemoClaw builds and pins them during the current operation.
 
 </AgentOnly>
 
 <AgentOnly variant="hermes">
 
 Set `NEMOCLAW_HERMES_SANDBOX_BASE_IMAGE_REF` to a Hermes sandbox-base tag or digest to override base-image resolution during onboarding.
-NemoClaw requires environment overrides to use the official remote repository and resolve to an immutable repository digest, validates the requested image for the required MCP runtime, and keeps the final image bound to that trusted base. Local bases are accepted only when NemoClaw builds and pins them during the current operation.
+NemoClaw requires environment overrides to use the official remote repository and resolve to an immutable repository digest, validates the requested image for the required MCP runtime, and keeps the final image bound to that trusted base.
+Local bases are accepted only when NemoClaw builds and pins them during the current operation.
 
 </AgentOnly>
 

src/lib/onboard/machine/jsonl-events.test.ts

@@ -16,7 +16,7 @@ import {
   withOnboardJsonlEventStream,
 } from "./jsonl-events";
 
-const SECRET = "sk-test-1234567890abcdefghijklmnop";
+const SECRET = "sk-aaaaaaaaaaaaaaaaaaaa";
 const CURRENT_SESSION_ID = "1784426400000-123e4567-e89b-42d3-a456-426614174000";
 const LEGACY_SESSION_ID = "1784426400000-ab12cd34";