docs: clarify policy preview and Station package state

docs/get-started/dgx-station-preparation.mdx

@@ -53,6 +53,14 @@ The installer records the override in the printed relogin command when Docker-gr
 
 On the generic Ubuntu path, accepting express install prepares the host with NVIDIA open driver `610.43.02`, Docker CE `29.6.1` with Buildx, and NVIDIA Container Toolkit `1.19.1`.
 Preparation probes package and runtime state first, reuses exact matches, and installs only missing pinned packages, including the NVIDIA Container Toolkit libraries and `nvidia-ctk` CLI.
+NemoClaw accepts an idle PackageKit daemon and quiesces it during repository and package changes.
+NemoClaw still stops before mutation when it finds any of these conditions:
+
+- An active or malformed PackageKit transaction.
+- An active APT or dpkg process or lock.
+- Unhealthy package state.
+- A failure in a required package or package-manager state query.
+
 It permits only the reviewed factory transition from `dkms` `3.0.11-1ubuntu13` to `1:3.4.0-1ubuntu1`.
 It also accepts an installed `dkms` `1:3.4.1-1ubuntu1` as a retained-compatible forward revision, warns that it differs from the validated `1:3.4.0-1ubuntu1` pin, excludes it from APT transactions, and continues runtime validation.
 Retention requires `dpkg` to report a fully installed package for `arm64` or architecture `all`; an unhealthy or malformed record, an unexpected architecture, or a package-query failure stops preparation before APT changes.

docs/network-policy/integration-policy-examples.mdx

@@ -75,6 +75,9 @@ Preview the endpoints before applying:
 $$nemoclaw my-assistant policy-add outlook --dry-run
 ```
 
+NemoClaw generates the preview from the exact preset policy YAML that `policy-add` would apply.
+It lists hosts, ports, access, protocol, TLS, and enforcement settings, HTTP methods and paths, and the binary allowlist.
+
 Apply the preset:
 
 ```bash