Land-ready proof for this PR:

Work done:

• Sandbox runtime/browser registry now reads/writes sandbox_registry_entries in the shared SQLite state DB.
• openclaw doctor --fix imports legacy monolithic JSON files and sharded registry directories into SQLite, preserves newer SQLite/sharded rows, and quarantines invalid legacy sources.
• Sandbox and doctor docs now describe SQLite as the canonical registry target.

Verification run locally:

• node scripts/run-vitest.mjs src/agents/sandbox/registry.test.ts src/commands/doctor-sandbox.warns-sandbox-enabled-without-docker.test.ts
• pnpm tsgo:core
• pnpm tsgo:core:test
• pnpm lint:kysely
• pnpm format:docs:check
• git diff --check
• .agents/skills/autoreview/scripts/autoreview --mode local clean, no accepted/actionable findings

Known proof gaps:

• No live Docker sandbox run; change is storage/doctor migration path and covered by focused registry/doctor tests.