fix(e2e): restore shared CLI artifact boundaries

.github/actions/restore-e2e-cli-artifact/action.yaml

@@ -146,7 +146,7 @@ runs:
           { echo "::error::exact-commit CLI artifact payload digest mismatch"; exit 1; }
         while IFS= read -r member; do
           case "$member" in
-            dist | dist/*) ;;
+            dist | dist/* | nemoclaw/dist/shared | nemoclaw/dist/shared/*) ;;
             *) echo "::error::CLI artifact contains an unsafe member: $member"; exit 1 ;;
           esac
           case "/$member/" in
@@ -158,17 +158,27 @@ runs:
           { echo "::error::CLI artifact contains a link or special file"; exit 1; }
         [[ ! -e "$GITHUB_WORKSPACE/dist" && ! -L "$GITHUB_WORKSPACE/dist" ]] ||
           { echo "::error::consumer unexpectedly built dist before artifact restore"; exit 1; }
+        [[ ! -e "$GITHUB_WORKSPACE/nemoclaw/dist" && ! -L "$GITHUB_WORKSPACE/nemoclaw/dist" ]] ||
+          { echo "::error::consumer unexpectedly built shared boundaries before artifact restore"; exit 1; }
         restore_dir="$(mktemp -d "${RUNNER_TEMP}/nemoclaw-cli-restore.XXXXXX")"
         trap 'rm -rf -- "$restore_dir"' EXIT
         tar --no-same-owner --no-same-permissions -xf "$payload" -C "$restore_dir"
         test -s "$restore_dir/dist/nemoclaw.js" ||
           { echo "::error::restored CLI artifact is missing dist/nemoclaw.js"; exit 1; }
+        for boundary in \
+          openshell-policy-boundary.cjs \
+          sandbox-name.cjs \
+          snapshot-sanitizer-boundary.cjs; do
+          test -s "$restore_dir/nemoclaw/dist/shared/$boundary" ||
+            { echo "::error::restored CLI artifact is missing shared boundary $boundary"; exit 1; }
+        done
         jq -e --arg candidateSha "$CANDIDATE_SHA" '
           type == "object" and
           (keys | sort) == ["nemoclawVersion", "sourceRevision"] and
           (.nemoclawVersion | strings | length > 0) and
           .sourceRevision == $candidateSha
         ' "$restore_dir/dist/build-identity.json" >/dev/null ||
           { echo "::error::restored CLI build identity does not match the candidate SHA"; exit 1; }
+        mv "$restore_dir/nemoclaw/dist" "$GITHUB_WORKSPACE/nemoclaw/dist"
         mv "$restore_dir/dist" "$GITHUB_WORKSPACE/dist"
         node "$GITHUB_WORKSPACE/bin/nemoclaw.js" --version >/dev/null