feat: keep the picker keys on screen and suggest prompts in next steps

[arunim2405]

Summary

• The StackGuardian agent picker shows its keys the whole time: space to select/unselect · enter to continue. Before, clack only showed them after you pressed enter with nothing selected.
• The closing Next steps note ends with a few prompts to try in your agent (security posture, why a workflow run failed, creating a workflow from a marketplace template, upgrading workflows).
• CHANGELOG.md entry for 1.0.7 and version bump.

Only the StackGuardian picker in src/sg/commands.ts changed; the upstream add-mcp install picker is untouched. The hint stays in the output after you submit, because it is part of the question text.

Test plan

• tests/e2e/sg-login-tty.test.ts checks for the hint and the suggested prompts (failed before the change, passes after)
• bun run typecheck
• bun run test (22/22 files)
• Run npx add-sg-mcp by hand and check the picker and the Next steps note

🤖 Generated with Claude Code

[arunim2405]

No findings.

Reviewed the complete four-file merge-base diff at fe3fb78dd8bf3784eecec1d2a6b3215aa5ae7bc4 (merge base cb52116f0e3a88a589a41139149eda7513491cbb), including the surrounding login/connect installation paths, Clack rendering, and registered PTY test. I found no actionable correctness, security, performance, or maintainability regressions.

Validation in an isolated archive of the exact head with frozen dependencies:

• bun run typecheck passed.
• bun run build passed.
• bun run test passed: 22/22 test files, including terminal login, standalone binary, and installer smoke coverage.
• GitHub build, test, and platform smoke checks passed.

Residual validation gap: the suggested prompts were checked as CLI output; their live StackGuardian operations were not exercised.

Verdict: approve. Submitted as a comment review because the authenticated account is the PR author and GitHub does not allow self-approval.