Enforce Switchyard routing network, retry, fallback, and cancellation policy #8888

Parent Epic: #7937\n\nDepends on the accepted multi-target provider boundary and on released upstream provider-transport protections.\n\n## Outcome\n\nNemoClaw enforces a least-privilege network, resource, diagnostic, and failure contract for Switchyard-routed Hermes calls without forking Switchyard provider transport or adding another routing loop.\n\n## Current upstream gate — 2026-08-25\n\nSwitchyard #271 closed unmerged and no accepted successor was found. That work carried redirect rejection, configurable connection and idle-read timeouts, bounded buffered and error bodies, bounded SSE frames, and credential/provider-body redaction. Switchyard #277 remains open for a separate total request timeout and judge-consultation deadline.\n\nCanonical NemoClaw support remains blocked until these guarantees, or an explicitly accepted equivalent, are released and qualified through the shared Switchyard runner/client used by the Relay plugin.\n\n## Scope\n\n- Permit only the approved sandbox-local provider boundary and explicitly approved telemetry destinations.\n- Deny direct access to upstream model-provider hosts and credential-bypass paths.\n- Consume the released Switchyard runner/client retry and candidate-fallback policy; do not add a second NemoClaw or plugin-owned rerouting/default-target loop.\n- Require the shared provider client to reject cross-authority redirects.\n- Require configurable connection, idle-read, and total-request bounds appropriate for the supported models; distinguish a stalled stream from an active long-running stream.\n- Bound buffered success bodies, retained error bodies, and individual SSE frames before untrusted metadata or line buffering can cause excessive allocation.\n- Keep credentials, static header values, provider-returned bodies, prompts, and secrets out of ordinary Display, Debug, tracing, routing events, and NemoClaw diagnostics.\n- Define the allowed judge/classifier failure policy and deadline. Any upstream classifier fail-open behavior must be explicitly accepted and observable; it cannot silently bypass the requested routing contract.\n- Define timeout, cancellation, shutdown, and the allowed runner/client candidate policy for the supported deployment.\n- Define behavior before and after the first streamed event; never restart a streamed answer in a way that can duplicate or splice output.\n- Record failures and any candidate fallback truthfully through the released routing evidence/status contract.\n- Treat missing released upstream protections as a release blocker rather than reimplementing a parallel HTTP client in NemoClaw.\n\n## Acceptance\n\n- [ ] Intended routed calls succeed while direct-provider egress is denied.\n- [ ] DNS, proxy, TLS, and redirect variants cannot bypass destination binding; a redirect target receives neither prompt nor credential.\n- [ ] Invalid target, connection failure, authentication denial, connect timeout, idle-read timeout, total deadline, rate limit, candidate exhaustion, judge failure, and cancellation have deterministic outcomes.\n- [ ] Inflated Content-Length metadata cannot trigger a large eager allocation before response bytes arrive.\n- [ ] Oversized buffered responses, retained error bodies, and SSE frames fail or truncate according to the released bounded contract without unbounded memory growth.\n- [ ] Provider credentials, static header values, provider bodies, prompts, and secrets are absent from Display, Debug, tracing, routing events, errors, and captured artifacts.\n- [ ] Candidate fallback occurs only through the accepted released Switchyard runner/client policy and is attempted at most as configured.\n- [ ] Judge/classifier timeout or failure is either rejected or follows one explicitly accepted, observable released policy; no silent routing bypass is reported as normal success.\n- [ ] NemoClaw and the Relay plugin do not rerun routing after a selected-target execution failure.\n- [ ] No retry begins after the first streamed event unless the released upstream contract explicitly supports safe continuation.\n- [ ] Restart, teardown, timeout, and cancellation leave no orphan Relay/Switchyard processes, streams, or provider calls owned by NemoClaw.\n- [ ] All transport and diagnostic protections are proven against the exact released runner/client artifact consumed by the native plugin on Linux amd64 and arm64.\n