Clarify configuration validation tests and tools

### description

there is more than one path to validation of envoy config:

- starting daemon in "validate" mode
- (python) protobuf validation

what these type of validation actually do, how best to validate, and what each tool validates is an ongoing source of confusion.

at very least we need to improve docs around dev/ci, and perhaps also clarify in main docs for end users