fix: harden claude-cli live switch smoke

scripts/lib/live-docker-stage.sh

@@ -40,7 +40,14 @@ openclaw_live_stage_state_dir() {
 
   mkdir -p "$dest_dir"
   if [ -d "$source_dir" ]; then
-    tar -C "$source_dir" --exclude=workspace -cf - . | tar -C "$dest_dir" -xf -
+    # Sandbox workspaces can accumulate root-owned artifacts from prior Docker
+    # runs. They are not needed for live-test auth/config staging and can make
+    # temp-dir cleanup fail on exit, so keep them out of the staged state copy.
+    tar -C "$source_dir" \
+      --exclude=workspace \
+      --exclude=sandboxes \
+      -cf - . | tar -C "$dest_dir" -xf -
+    chmod -R u+rwX "$dest_dir" || true
     if [ -d "$source_dir/workspace" ] && [ ! -e "$dest_dir/workspace" ]; then
       ln -s "$source_dir/workspace" "$dest_dir/workspace"
     fi

scripts/test-live-cli-backend-docker.sh

@@ -210,6 +210,7 @@ docker run --rm -t \
   -e OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV="${OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV:-}" \
   -e OPENCLAW_LIVE_CLI_BACKEND_DISABLE_MCP_CONFIG="$CLI_DISABLE_MCP_CONFIG" \
   -e OPENCLAW_LIVE_CLI_BACKEND_RESUME_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_RESUME_PROBE:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_MODEL_SWITCH_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_MODEL_SWITCH_PROBE:-}" \
   -e OPENCLAW_LIVE_CLI_BACKEND_IMAGE_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_IMAGE_PROBE:-}" \
   -e OPENCLAW_LIVE_CLI_BACKEND_IMAGE_ARG="${OPENCLAW_LIVE_CLI_BACKEND_IMAGE_ARG:-}" \
   -e OPENCLAW_LIVE_CLI_BACKEND_IMAGE_MODE="${OPENCLAW_LIVE_CLI_BACKEND_IMAGE_MODE:-}" \