fix: install script improvements

[nickh-obol]

Summary

• Docker permission detection: Distinguish "permission denied" from "daemon not running" — tells users to add themselves to the docker group instead of misleadingly saying Docker is not installed
• Headless DNS support: Make wildcard DNS (NetworkManager/dnsmasq) opt-in via --wildcard-dns flag. /etc/hosts is now the primary mechanism, which works on all Linux systems including headless servers. The old behavior restarted NetworkManager and swapped /etc/resolv.conf, which could break host DNS resolution
• PATH available immediately: Export OBOL_BIN_DIR to PATH during install_dependencies so helm/helmfile are found by obol bootstrap in the same process
• Upfront prerequisite checks: Verify npm/Node.js before starting downloads, not midway through
• OpenClaw version bump: v2026.3.13-1 → v2026.3.24 (old version was missing from npm)

Test plan

Shell script changes (testable immediately — obolup.sh runs directly):

• Run obolup.sh on a fresh headless Linux machine (no NetworkManager) — should complete without DNS errors
• Run obolup.sh on a machine where Docker is installed but user is not in docker group — should show permission error, not "Docker not installed"
• Verify obol bootstrap finds helm after fresh install (no manual PATH export needed)
• Verify openclaw npm install succeeds with version 2026.3.24

Go binary changes (require a new release — obolup.sh downloads prebuilt binaries):

• Run obol stack up — should only write /etc/hosts, no NM/resolv.conf changes
• Run obol stack up --wildcard-dns — should configure NM dnsmasq as before

To test Go changes before a release, build from source: OBOL_DEVELOPMENT=true go build -o ~/.local/bin/obol ./cmd/obol