fix(container): address all container anti-patterns (4.1–4.4)

- Replace broad COPY . . with targeted COPY src/ and firmware/ to
  preserve Docker layer cache across non-build file changes (4.1)
- Inline permissions/config prep into builder stage, removing the
  extra busybox stage and its maintenance/security overhead (4.2)
- Strip heavy dev tools (vim, git, iputils-ping, openssl) from dev
  image, keeping only ca-certificates and curl (4.3)
- Replace expensive zeroclaw doctor healthcheck with lightweight
  zeroclaw status; increase interval from 30s to 60s (4.4)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

docker-compose.yml

@@ -49,10 +49,11 @@ services:
           cpus: '0.5'
           memory: 512M
 
-    # Health check
+    # Health check — uses lightweight status instead of full diagnostics.
+    # For images with curl, prefer: curl -f http://localhost:3000/health
     healthcheck:
-      test: ["CMD", "zeroclaw", "doctor"]
-      interval: 30s
+      test: ["CMD", "zeroclaw", "status"]
+      interval: 60s
       timeout: 10s
       retries: 3
       start_period: 10s