Document the builder's two roles and expose the validation port

[0w3n-d]

Issue: #527 (step 10 of 10)

Base branch: od/builder-sim-servers-step9 (#543, step 9). Retarget as the
stack merges.

What this PR does

Docs and one port. builder.Dockerfile exposes 8552, and the README now opens
with the two roles and which config selects each, then documents how to run
either.

The part worth reviewing is the list of ways the simulation role differs from
crates/simulator, since an operator pointing traffic at it needs all of them:

• inclusion lists are not enforced, so a block violating a submitted list
  passes here and fails there;
• the disallow list rejects interaction by effect, while crates/simulator
  also rejects a block that merely reads a listed account, so it rejects
  strictly more blocks;
• only Fulu (V5) and the relay-internal merged method are served;
• SSZ only, so a relay without ssz_url cannot use it;
• release builds only: a 128 KiB blob overflows a debug build's stack;
• until blacklist_endpoint answers, the list is empty and nothing is
  filtered.

What this PR deliberately does not do

No separate Dockerfile. Both roles are one binary, so builder.Dockerfile
covers them, and no compose or deployment manifests are touched.

Tests

None: docs and an EXPOSE line. just fmt-check, just test and
cargo clippy --all-features --no-deps -- -D warnings still pass, and CI
builds the image.

Reviewer checklist

• CI (lint, unit-test) is green
• Matches the linked issue/step
• No unexplained scope creep or unrelated files touched