Move the gateway VM launching out of `nemoclaw gateway` into its own
`gateway` binary built from the navigator-vm crate. The nemoclaw CLI
no longer links against libkrun or requires macOS hypervisor codesigning.
Add scripts/bin/gateway wrapper (build + codesign + exec) and clean up
scripts/bin/nemoclaw to remove navigator-vm artifacts.
