refactor: drive headless validators via the static runtime override

[nicosampler]

Summary

Closes #23

Follow-up to #21: the headless-validator mechanism was the last place generating YAML from JS
(writeGeneratedOverride string-building .generated/service-overrides.yaml on every run). It now
rides the same static, env-var-driven override as the SV UIs, so there is a single mechanism and no
YAML codegen anywhere.

Changes

• templates/runtime-overrides.yaml gains one mount per validator with a fixed, readable target:
  ${APP_*_NGINX_ROUTES}:/etc/nginx/templates/<name>.conf.template. The env var selects the source:
  Splice's real routing config when ui: true (identical to vanilla after compose dedups the mount),
  or an empty .generated/empty-nginx-routes.conf when the validator is headless or disabled.
• writeGeneratedOverride and .generated/service-overrides.yaml removed; writeLocalnetEnv writes
  the APP_PROVIDER_NGINX_ROUTES / APP_USER_NGINX_ROUTES vars instead.
• Tests for the route-source contract in scripts/runtime-plan.test.js; docs and template comments
  updated.
• fix(smoke): pre-existing breakage on main — feat: wire sv web UI flags to runtime via static override #21 shipped the scaffolded sv defaults as all-off,
  but smoke.js still asserted all-on, so npm run test:e2e failed. Assertions aligned.

Acceptance criteria

• Headless validators are driven by templates/runtime-overrides.yaml via env vars, with behavior
  identical to today (backend reachable on direct ports, no nginx routes, nginx boots).
• writeGeneratedOverride and .generated/service-overrides.yaml are removed, along with the
  conditional -f wiring in dockerComposeArgs.
• Docs and comments updated: README design notes and the splice-localnet-overrides.yaml header.
• Tests updated (runtime-plan.test.js) and verified against a live stack with a headless and a
  UI-enabled validator.

Note: the issue sketched Splice's .c${VAR}f.template filename trick; implemented with a clearer
equivalent — fixed mount target, env var selects the source file — avoiding the cryptic on/off
concatenation.

Test plan

Automated tests

• scripts/runtime-plan.test.js — route-source env contract (empty file for headless/disabled,
  Splice's real config for ui: true).
• Run with npm test (26 passing); npm run test:e2e for the smoke test (fixed here).

Manual verification

Against the live stack: with appUser.ui: true, wallet and ANS serve 200 on port 2000; with
ui: false, no UI containers run, port 2000 refuses connections, the rendered app-user.conf inside
nginx is 0 bytes, and the backend answers 200 on its direct port (:2975). nginx boots in every
combination, including all SV UIs and all validator UIs off simultaneously.

Breaking changes

None.

Checklist

• Self-reviewed my own diff
• Tests added or updated
• Docs updated (if applicable)
• No unrelated changes bundled in

Screenshots

None.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.