Vouch Request: fix resolve_from() silent fallback + add Docker snapshot health check

[tommylin-signalpro]

Hi — requesting vouch to contribute two bug fix PRs.

About me

I ran into these bugs while installing NemoClaw on a non-standard environment (Intel Mac + Colima + Docker-wrapped openshell CLI). I traced both issues to their root cause in the OpenShell Rust codebase and have fixes ready.

Intended PRs

PR 1: sandbox create --from silently treats non-existent paths as image references

Bug: When --from /path/to/Dockerfile is given and the path doesn't exist, resolve_from() in crates/openshell-cli/src/run.rs (~line 2524) falls through to treating the path as a container image reference. Kubernetes then fails with InvalidImageName instead of a clear "file not found" error.

Root cause: The fallback condition value.contains('/') matches filesystem paths that don't exist, silently converting them to image references.

Fix: Add a path-existence check before the image-reference fallback — if the value looks like a filesystem path (starts with /, ./, or ~/) but doesn't exist, return an error with a clear message.

PR 2: openshell doctor check — detect stale Docker snapshots

Bug: Failed image pulls can leave stale containerd snapshots that permanently block subsequent pulls. Users see docker pull hang forever with no diagnostic output. The only fix is docker system prune -f, but openshell doctor check doesn't detect this condition.

Fix: Add a new check in doctor_check() that detects dangling/stale snapshots via the bollard Docker API and suggests docker system prune -f when found.

Context

I documented the full debugging journey in NVIDIA/NemoClaw#446 comment and submitted NVIDIA/NemoClaw#1325 for a related health-poll fix. The OpenShell bugs were discovered during that process.

I understand the code I'm proposing to change and can explain the reasoning behind every line.