Revert ONBUILD: explicitly COPY policy.yaml in child images

Author: drew

sandboxes/base/Dockerfile

@@ -69,10 +69,6 @@ FROM devtools AS final
 # Ensure policy directory exists
 RUN mkdir -p /etc/navigator
 
-# Auto-copy policy.yaml from child build contexts if present.
-# The trailing wildcard means the COPY is a no-op when the file doesn't exist.
-ONBUILD COPY policy.yaml* /etc/navigator/
-
 # Set up sandbox user home directory
 RUN mkdir -p /sandbox/.claude/skills /sandbox/.agents/skills /sandbox/.openclaw/skills && \
     printf 'export PS1="\\u@\\h:\\w\\$ "\n' > /sandbox/.bashrc && \

sandboxes/openclaw/Dockerfile

@@ -17,7 +17,8 @@ USER root
 # Install OpenClaw CLI
 RUN npm install -g openclaw
 
-# policy.yaml is automatically copied by the base image ONBUILD directive
+# Copy sandbox policy
+COPY policy.yaml /etc/navigator/policy.yaml
 
 # Copy the OpenClaw startup helper
 COPY openclaw-start.sh /usr/local/bin/openclaw-start