feat(cua): add gated candidate install readiness

ci/source-architecture-budget.json

@@ -12,7 +12,7 @@
       "src/lib/adapters/openshell/timeouts.ts": 37,
       "src/lib/agent/defs.ts": 32,
       "src/lib/cli/branding.ts": 87,
-      "src/lib/cli/nemoclaw-oclif-command.ts": 106,
+      "src/lib/cli/nemoclaw-oclif-command.ts": 124,
       "src/lib/cli/terminal-style.ts": 45,
       "src/lib/core/json-types.ts": 37,
       "src/lib/core/ports.ts": 88,
@@ -23,11 +23,11 @@
       "src/lib/inference/config.ts": 29,
       "src/lib/inference/web-search.ts": 21,
       "src/lib/messaging/channels/index.ts": 25,
-      "src/lib/onboard/gateway-binding.ts": 49,
+      "src/lib/onboard/gateway-binding.ts": 47,
       "src/lib/runner.ts": 88,
       "src/lib/security/redact.ts": 51,
       "src/lib/state/onboard-session.ts": 36,
-      "src/lib/state/registry.ts": 98,
+      "src/lib/state/registry.ts": 99,
       "src/lib/state/state-root.ts": 22,
       "src/lib/subprocess-env.ts": 24,
       "src/lib/validation.ts": 25
@@ -60,6 +60,6 @@
     "src/lib/actions/sandbox": 184,
     "src/lib/state": 37,
     "src/lib/inference": 63,
-    "scripts": 46
+    "scripts": 47
   }
 }

ci/source-shape-test-budget.json

@@ -41,6 +41,31 @@
       "test": "matches the bundled local-inference host-gateway ports (#5744)",
       "category": "compatibility"
     },
+    {
+      "file": "test/brev-launchable-cua-gpu.test.ts",
+      "test": "pins the privileged interpreter and fixed host helpers outside caller PATH",
+      "category": "security"
+    },
+    {
+      "file": "test/brev-launchable-cua-gpu.test.ts",
+      "test": "binds every qualification artifact execution to the exact source digest",
+      "category": "security"
+    },
+    {
+      "file": "test/brev-launchable-cua-gpu.test.ts",
+      "test": "rejects a real Git replacement that conceals replacement-controlled source bytes",
+      "category": "security"
+    },
+    {
+      "file": "test/brev-launchable-cua-gpu.test.ts",
+      "test": "accepts an exact checkout through the production verifier with real Git",
+      "category": "security"
+    },
+    {
+      "file": "test/brev-launchable-cua-gpu.test.ts",
+      "test": "rejects real Git %s concealment in the production bootstrap verifier",
+      "category": "security"
+    },
     {
       "file": "test/candidate-compat.test.ts",
       "test": "keeps the manual controller read-only and runs digest-bound deterministic and live lanes (#6691)",
@@ -146,6 +171,11 @@
       "test": "hermes-e2e: install.sh onboards Hermes and proves health plus live inference",
       "category": "security"
     },
+    {
+      "file": "test/e2e/support/cua-qualification-artifact-runner.test.ts",
+      "test": "declares the closed Noble-compatible service and command grammar",
+      "category": "security"
+    },
     {
       "file": "test/e2e/support/dockerhub-auth-workflow-boundary.test.ts",
       "test": "binds the cleanup action and helper content to the pinned commit",

ci/test-file-size-budget.json

@@ -5,6 +5,9 @@
     "nemoclaw/src/commands/migration-state.test.ts": 1562,
     "src/lib/inference/nim.test.ts": 2068,
     "src/lib/onboard/preflight.test.ts": 1904,
+    "test/brev-launchable-cua-gpu.test.ts": 2099,
+    "test/e2e/live/cua-gpu-qualification.test.ts": 1669,
+    "test/e2e/support/cua-qualification-receipt.test.ts": 1757,
     "test/generate-openclaw-config.test.ts": 1941,
     "test/install-preflight.test.ts": 3921,
     "test/nemoclaw-start.test.ts": 4791,

package.json

@@ -122,6 +122,8 @@
     "nemoclaw-blueprint/",
     "managed-inference/",
     "schemas/network-policy.schema.json",
+    "schemas/cua-lifecycle.schema.json",
+    "schemas/cua-target-manifest.schema.json",
     "schemas/sandbox-policy.schema.json",
     "scripts/",
     "docs/resources/local-credential-form.html",