fix(security): surface immutable symlink hardening status

[13ernkastel]

Summary

This follow-up builds on #1137 and improves the observability around immutable symlink hardening without changing the underlying defense-in-depth approach.

What Changed

• factors .openclaw symlink validation into a reusable helper so both startup paths use the same validation logic
• adds explicit security logging when immutable hardening succeeds, is partial, or is skipped because chattr is unavailable
• extends the gateway-isolation E2E to fail if chattr is missing from the image, so the mitigation cannot silently disappear

Why

The original immutable-hardening fix is directionally strong, but the chattr path is intentionally best-effort and currently silent. That makes the mitigation harder to trust and harder to debug because:

• a missing chattr binary looks the same as successful hardening
• partial chattr +i failures are suppressed with no visibility
• the image can regress and stop shipping chattr without CI catching it

These changes make the mitigation easier to audit while staying compatible with the current layered hardening model.

Validation

• bash -n scripts/nemoclaw-start.sh
• bash -n test/e2e-gateway-isolation.sh
• git diff --check
• not run: test/e2e-gateway-isolation.sh (docker is not installed in this environment)

Relationship To #1137

This is a repost of the follow-up originally opened as latenighthackathon/NemoClaw#1, now targeted at NVIDIA/NemoClaw as requested.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 632b172e-4dbc-494a-8be2-9a1f1a6f5691

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

This repository limits contributors to 10 open pull requests. Please close or merge existing PRs before opening new ones.