nono profiles: per-profile runtime start check; tps-backup/restore /home; roster CWD; status writes; CI token before cargo; fake extends (cli#351 follow-ups) #354

Follow-ups from cli#351 (S1b profiles), dispositioned at merge. None touches the S1b invariant (the tps-agent-run launch read set, which the gate proves at runtime on both OSes); all are profile/CI hardening for surfaces the gate only validates statically today.

1. Per-profile runtime start check in scripts/check-nono-profiles.sh. nono profile validate --strict passes profiles that Landlock cannot enforce at run time (a deny nested under an allowed parent makes nono refuse to START). Add, for every shipped profile on both lanes: nono run --profile <p> -- true exits 0. This is the check that would have caught items 2–3.
2. tps-backup grants /home (contains inherited denies ~/.tps/secrets, ~/.ssh → deny-within-allow → nono refuses to initialise on Linux). Replace with the specific non-sensitive subdirectories the backup needs.
3. tps-restore grants /home — same class; pass the target workspace at launch (--workdir / a runtime grant) instead.
4. tps-roster reads the caller's CWD — buildNonoArgs always adds --allow-cwd and the profile's workdir.access is read; the roster needs only ~/.openclaw/openclaw.json. Change the inheritance so the resolved profile has no automatic CWD access (none alone inherits tps-base's readwrite).
5. tps-status grants read-write on /workspace and the workdir while status writes are required to stay under ~/.tps/status — use read (not none, which inherits the base).
6. test.yml profile-gate job persists GITHUB_TOKEN before compiling third-party Rust (actions/checkout writes it into the workspace git config; the pinned nono cargo build runs on the same runner). Set persist-credentials: false on that checkout and an explicit permissions: contents: read on the job (the flair canary's shape).
7. Test fake nono accepts path components in extends (../ escapes the profile dirs; a malformed profile could pass fake strict validation). Validate base_name as a single profile-name component.

Refs #341 #351.