Select the building role from a supplied config

[0w3n-d]

Issue: #550 (step 1 of 6)

What this PR does

Adds BuildingConfig (--build.config) and turns Roles from an enum into a
struct of three optional configs. As an enum, a third role needs seven
variants.

The building role reads its own two keys, BUILDER_BLS_KEY (signs the
submission) and BUILDER_PAYOUT_KEY (pays the proposer). RELAY_KEY cannot
serve: the merging role parses it as secp256k1, and
helix_common::config::load_keypair parses it as BLS. Both are loaded and
logged before the node boots, so a bad key fails immediately and the operator
sees which pubkey to register and which address to fund.

What this PR deliberately does not do

It does not build or submit anything. Nothing is spawned. Steps 2-5 add the
slot context, block assembly, submission and the slot loop. subsidy_wei and
self_validate carry #[allow(dead_code)] until steps 3 and 5 read them.

Tests

14 new, all written before the implementation and signed off first.

• BuildingConfig (8): the shipped example parses; the three required fields
  alone yield every default; an unknown field is rejected; a payout reserve
  below the intrinsic 21 000 gas is rejected, as is an empty
  submit_offsets_ms, a schemeless relay_url, and extra_data over 32
  bytes. a_zero_subsidy_is_allowed pins the opt-out.
• Roles (2 new, 4 updated): a build config alone selects the building role;
  all three configs select all three; supplying none is still an error.
• BuildingKeys (4): hex parses with and without 0x; each malformed key is
  named in its own error; the pubkey and payout address are derived.
  parse() is split from load() so tests never touch process-wide env vars.

103 pass in the crate.

Notes for the reviewer

Two things found rather than introduced, neither fixed here:

• cargo clippy -p helix-builder reports 6 pre-existing errors in
  engine/* and validation/mod.rs. The documented command,
  cargo clippy --all-features --no-deps, lints only crates/relay because
  that is the workspace's default-members — so this crate has never been
  linted in CI. --all-targets finds 4 more in test code. Worth a follow-up.
• One unused import in validation/server_tests.rs is removed here as a
  drive-by; it arrived with Serve the SSZ validation routes from the simulation role #543 and blocked a clean build of this crate.

Reviewer checklist

• CI (lint, unit-test) is green
• Matches the linked issue/step
• No unexplained scope creep or unrelated files touched