fix(docker): use COPY --chmod to avoid duplicate layer in transcription-proxy

[basnijholt]

Summary

• Use COPY --chmod=755 to set permissions during copy instead of running chmod -R afterward
• Eliminates ~38MB wasted layer caused by Docker storing modified file metadata as a new layer
• The RUN command now only sets permissions on parent directories (essentially 0B)

Problem

The previous Dockerfile created two layers for the same content:

COPY --from=builder /root/.local/share/uv/tools/agent-cli /root/.local/share/uv/tools/agent-cli
RUN chmod -R 755 /root/.local/share/uv/tools/agent-cli && ...

This caused Docker to store the directory twice because modifying file metadata creates a new layer.

Solution

COPY --from=builder --chmod=755 /root/.local/share/uv/tools/agent-cli /root/.local/share/uv/tools/agent-cli
RUN chmod 755 /root /root/.local ... && ln -s ...  # Only parent dirs

Test plan

• Docker build succeeds
• Verified chmod layer is now 0B via docker history
• Pre-commit passes
• Pytest passes (909 passed)