test: cover nginx config generator directly

[djchen]

Summary

• add direct Bun tests for generate-nginx-config.sh using an isolated runtime root
• shrink the Docker runtime regression script back to image/nginx smoke coverage
• refine AGENTS.md wording for wrapper/runtime contracts

Testing

• bun test
• bun run test:compat
• bun run typecheck
• bun run lint
• bun run format:check