feat(onboard): activate buildless managed onboarding

.github/actions/ci-static-checks/action.yaml

@@ -41,6 +41,12 @@ runs:
       shell: bash
       run: npm install --ignore-scripts
 
+    - name: Verify reviewed runtime bundles
+      shell: bash
+      run: |
+        npm --prefix tools/mcp-tool-discovery-runtime ci --ignore-scripts --no-audit --no-fund
+        npm --prefix tools/mcp-tool-discovery-runtime run bundle:reviewed:check
+
     - name: Validate config schemas
       shell: bash
       run: npm run validate:configs

.github/workflows/e2e-standard-profile.yaml

@@ -21,6 +21,9 @@ on:
       cli_artifact_provenance:
         required: true
         type: string
+      managed_image_catalog:
+        required: true
+        type: string
       credential_boundary:
         required: true
         type: string
@@ -196,12 +199,18 @@ jobs:
             exit 1
           }
 
-          if [[ "${REPOSITORY}" != "NVIDIA/NemoClaw" || "${REF}" != "refs/heads/main" ]]; then
-            fail "workflow must run from NVIDIA/NemoClaw main"
+          if [[ "${REPOSITORY}" != "NVIDIA/NemoClaw" ]]; then
+            fail "workflow must run from NVIDIA/NemoClaw"
           fi
           if [[ "${EVENT_NAME}" != "push" && "${EVENT_NAME}" != "workflow_dispatch" ]]; then
             fail "workflow event must be push or workflow_dispatch"
           fi
+          if [[ "${EVENT_NAME}" == "push" && "${REF}" != "refs/heads/main" ]]; then
+            fail "push workflow must run from NVIDIA/NemoClaw main"
+          fi
+          if [[ "${EVENT_NAME}" == "workflow_dispatch" && "${REF}" != refs/heads/* ]]; then
+            fail "manual workflow must run from an NVIDIA/NemoClaw branch"
+          fi
           # PR E2E mode: maintainer-dispatched PR commit.
           if [[ "${EVENT_NAME}" == "workflow_dispatch" && -n "${CHECKOUT_SHA}" ]]; then
             if [[ ! "${CHECKOUT_SHA}" =~ ^[0-9a-f]{40}$ ]]; then
@@ -356,6 +365,7 @@ jobs:
         with:
           repository: ${{ inputs.candidate_repository }}
           ref: ${{ inputs.candidate_sha }}
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Authenticate to Docker Hub
@@ -382,6 +392,45 @@ jobs:
         with:
           provenance-json: ${{ inputs.cli_artifact_provenance }}
 
+      - name: Materialize temporary managed-image catalog
+        if: ${{ inputs.managed_image_catalog != '' }}
+        shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+        env:
+          CANDIDATE_SHA: ${{ inputs.candidate_sha }}
+          MANAGED_IMAGE_CATALOG: ${{ inputs.managed_image_catalog }}
+          RESTORE_CLI: ${{ inputs.restore_cli && 'true' || 'false' }}
+        run: |
+          set -euo pipefail
+          catalog_path="${RUNNER_TEMP}/e2e-managed-image-catalog.json"
+          jq -e --arg revision "$CANDIDATE_SHA" '
+            type == "object" and length > 0 and
+            all(.[];
+              .source.revision == $revision and
+              (.source.release | type == "string" and length > 0) and
+              (.source.cohort | type == "string" and length > 0)
+            ) and
+            ([.[].source.release] | unique | length) == 1 and
+            ([.[].source.cohort] | unique | length) == 1
+          ' <<<"$MANAGED_IMAGE_CATALOG" >/dev/null || {
+            echo "::error::managed-image catalog source identity does not match the candidate" >&2
+            exit 1
+          }
+          if [[ "$RESTORE_CLI" == "true" ]]; then
+            candidate_release="v$(jq -r '.nemoclawVersion' dist/build-identity.json)"
+            jq -e --arg release "$candidate_release" '
+              all(.[]; .source.release == $release)
+            ' <<<"$MANAGED_IMAGE_CATALOG" >/dev/null || {
+              echo "::error::managed-image catalog release does not match the restored CLI" >&2
+              exit 1
+            }
+          fi
+          jq -c . <<<"$MANAGED_IMAGE_CATALOG" >"$catalog_path"
+          [[ -s "$catalog_path" && ! -L "$catalog_path" ]] || {
+            echo "::error::temporary managed-image catalog is invalid" >&2
+            exit 1
+          }
+          printf 'NEMOCLAW_E2E_MANAGED_IMAGE_CATALOG=%s\n' "$catalog_path" >>"$GITHUB_ENV"
+
       - name: Install reviewed cloudflared
         if: ${{ inputs.cloudflared }}
         shell: /bin/bash --noprofile --norc -e -o pipefail {0}
@@ -433,12 +482,18 @@ jobs:
             exit 1
           }
 
-          if [[ "${REPOSITORY}" != "NVIDIA/NemoClaw" || "${REF}" != "refs/heads/main" ]]; then
-            fail "workflow must run from NVIDIA/NemoClaw main"
+          if [[ "${REPOSITORY}" != "NVIDIA/NemoClaw" ]]; then
+            fail "workflow must run from NVIDIA/NemoClaw"
           fi
           if [[ "${EVENT_NAME}" != "push" && "${EVENT_NAME}" != "workflow_dispatch" ]]; then
             fail "workflow event must be push or workflow_dispatch"
           fi
+          if [[ "${EVENT_NAME}" == "push" && "${REF}" != "refs/heads/main" ]]; then
+            fail "push workflow must run from NVIDIA/NemoClaw main"
+          fi
+          if [[ "${EVENT_NAME}" == "workflow_dispatch" && "${REF}" != refs/heads/* ]]; then
+            fail "manual workflow must run from an NVIDIA/NemoClaw branch"
+          fi
           if [[ "${EVENT_NAME}" == "workflow_dispatch" && -n "${CHECKOUT_SHA}" ]]; then
             if [[ ! "${CHECKOUT_SHA}" =~ ^[0-9a-f]{40}$ ]]; then
               fail "checkout SHA must be lowercase 40-hex"
@@ -580,7 +635,7 @@ jobs:
           [[ "$JOB_STATUS" =~ ^(success|failure|cancelled)$ ]] || { echo "::error::E2E job status is invalid" >&2; exit 1; }
           [[ "$ARTIFACT_DIRECTORY" =~ ^e2e-artifacts/live/[a-z0-9]+([_-][a-z0-9]+)*(/[a-z0-9]+([_-][a-z0-9]+)*)?$ ]] || { echo "::error::E2E artifact directory is invalid" >&2; exit 1; }
           install -d -m 0700 "$ARTIFACT_DIRECTORY"
-          product_evidence_count="$(find -P "$ARTIFACT_DIRECTORY" -type f ! -name evidence-manifest.json -printf . | wc -c)"
+          product_evidence_count="$(find -P "$ARTIFACT_DIRECTORY" -type f ! -name evidence-manifest.json -exec printf . \; | wc -c | tr -d '[:space:]')"
           if [[ "$JOB_STATUS" == "success" && "$product_evidence_count" == "0" ]]; then
             echo "::error::successful E2E target produced no product evidence" >&2
             exit 1