“NVIDIA's agent runtime, called Nemo Claw, operates within a secure container named Open Shell.”