fix(run): fetch every secret without --only, and clear the spinner on --json errors

[radim10]

Summary

• run without --only started the command with no secrets. Since b703cb2, stashbase run -p <project> -e <env> -- cmd skipped the secrets request: an empty --only was read as "nothing left to fetch" instead of "every secret". It printed "Egress-only profile (0 secrets)" and exited 0. Plain run now fetches every secret again. An agent run still fetches only the secrets its profile binds, so an empty binding list there still means none. That's important: otherwise an agent could receive the whole environment.
• "Egress-only profile" is agent-only wording. Plain run now always prints Environment loaded (N secrets).
• --json errors no longer get glued to the spinner. The "no secrets found" error was printed after the spinner frame (Loading environment...{), so the output wasn't clean JSON. The spinner is now cleared first, as in the text output and in pull.

Test plan

• New integration test: run without --only attempts the fetch and doesn't start the command when it fails (fails on master: the child ran and exited 0)
• New integration test: a --json error doesn't follow the spinner frame on the same line
• Unit tests for the fetch decision (plain run, agent run, local file covering every requested secret) and for the loaded message
• Reproduced the --json spinner bug by hand before the fix and confirmed it after
• cargo fmt --check and cargo test pass
• Checked by hand against the staging API: a fetched secret reaches the child process