Persist Odoo override payloads into web runtime env

[cbusillo]

Summary

• expose the typed Odoo override payload and required flags in the raw compose env anchor used by web and script-runner
• persist deploy-phase override payloads into Dokploy target env before web redeploy, with provider readback checks and stale-key cleanup
• fail stable target replacement before deploy when a secret-backed override references missing neutral secret env keys
• document the runtime handoff and fail-closed provider readback behavior

Tests

• uv run python -m unittest tests.test_dokploy tests.test_odoo_instance_overrides tests.test_odoo_stable_target_replacement
• uv run --extra dev ruff format --check control_plane/dokploy.py control_plane/odoo_instance_overrides.py control_plane/workflows/odoo_stable_target_replacement.py tests/test_dokploy.py tests/test_odoo_instance_overrides.py tests/test_odoo_stable_target_replacement.py
• uv run --extra dev ruff check --diff control_plane/dokploy.py control_plane/odoo_instance_overrides.py control_plane/workflows/odoo_stable_target_replacement.py tests/test_dokploy.py tests/test_odoo_instance_overrides.py tests/test_odoo_stable_target_replacement.py
• uv run --extra dev ruff check control_plane/dokploy.py control_plane/odoo_instance_overrides.py control_plane/workflows/odoo_stable_target_replacement.py tests/test_dokploy.py tests/test_odoo_instance_overrides.py tests/test_odoo_stable_target_replacement.py

Review

Focused review agents found stale target-env cleanup and missing secret-env predeploy validation gaps; both are addressed in this PR with tests.

Companion

Pairs with cbusillo/odoo-devkit#68, which adds the Odoo-side fail-closed runtime guards for these flags.