fix(dev): prompt for credentials before image build + fix CLI execute bit

[johnsonshi]

Problem

When azureclaw dev --build is run for the first time (no ~/.azureclaw/config.json), the credential prompt doesn't work properly. Additionally, make install-cli results in a permission denied error when running azureclaw.

Root causes

1. Wrong step order — Credentials were prompted at step 2, after the Docker image build (step 1), which can take 10-20 minutes for Rust compilation. Users should be asked for credentials first.

2. Spinner hides interactive prompt — stepper.step("Loading credentials...") starts an ora spinner that's still animating when inquirer.prompt() tries to display the interactive endpoint/model/API-key inputs. The spinner overwrites the prompt text, making it invisible or unresponsive.

3. Missing execute bit on dist/index.js — tsc doesn't preserve the executable permission on output files, so after npm link, running azureclaw fails with EACCES: permission denied.

Changes

cli/src/commands/dev.ts

• Move credential check to step 1 (before image resolution/build)
• Stop the stepper spinner before calling promptAndSaveCredentials() so inquirer prompts display correctly
• Import loadConfig + promptAndSaveCredentials directly instead of ensureCredentials for finer control

cli/package.json

• Add chmod +x dist/index.js to the build script so the CLI entry point is always executable after tsc

New first-run flow

1/3 ✓ Credentials configured       ← prompts immediately
2/3 ● Building sandbox image...     ← long build happens after creds are saved
3/3 ✓ Sandbox running

Testing

• tsc --noEmit passes
• All 159 vitest tests pass
• oxlint — 0 errors
• make install-cli → azureclaw --help works (no permission denied)

[johnsonshi]

Test plan:

 # ── 1. Tear down running dev containers + AGT stack ──────────
 docker rm -f azureclaw-dev-agent azureclaw-agt-relay azureclaw-agt-registry azureclaw-agt-postgres 2>/dev/null
 docker network rm azureclaw-dev 2>/dev/null
 docker volume rm azureclaw-dev-agent-data 2>/dev/null
 
 # ── 2. Remove dev Docker images ──────────────────────────────
 docker rmi azureclaw-sandbox:dev azureclaw-inference-router:dev agentmesh-relay:dev agentmesh-registry:dev 2>/dev/null
 
 # ── 3. Delete saved credentials (forces first-run prompt) ────
 rm -rf ~/.azureclaw
 
 # ── 4. Clean + rebuild + install CLI ─────────────────────────
 cd /Users/johnsonshi/repos/azureclaw.git/branches/johsh/fix-dev-credentials-prompt
 make clean
 make install-cli
 
 # ── 5. Verify CLI is executable ──────────────────────────────
 azureclaw --help
 
 # ── 6. Run dev --build (should prompt for creds FIRST) ───────
 azureclaw dev --build
 # Expected: immediately prompts for endpoint, model, API key
 #           BEFORE any Docker build starts

What to verify:

 - Step 5: azureclaw --help runs without permission denied
 - Step 6: credential prompts appear immediately (not after image build), inputs are visible (no spinner overwriting), and after entering valid creds they're saved to ~/.azureclaw/config.json + ~/.azureclaw/secrets.json