NemoClaw vs. Grith: Sandbox for One Agent vs. Security for All