fix(api): replace runner list overrides

[floze-the-genius]

Summary

• make all remaining OverrideRunnerSpec list fields use layer-level replacement instead of merging repository and layer values
• preserve repository lists when the layer does not provide an override
• strengthen regression tests with full ordered structure comparisons while treating nil and empty collections equivalently

Closes #420

Validation

• go test ./api/v1alpha1
• go vet ./...
• make test (Kubernetes envtest 1.36.0 plus Azurite, MinIO, LocalStack, and fake GCS Docker services; cleanup completed)
• git diff --check

AI assistance disclosure

I used OpenAI Codex to help analyze the issue, implement the change, and update the regression tests. I reviewed the resulting diff and ran the validation commands listed above.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4be731229b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Honor explicit empty list overrides

When a TerraformLayer deliberately sets a list override such as imagePullSecrets: [] to clear repository defaults, this falls back to the repository slice because it keys off len(result) == 0. That still violates the documented list semantics in docs/user-guide/override-runner.md that layer arrays fully replace repository arrays, and the same len-based pattern is repeated for the other list helpers changed here; use nil-vs-empty presence instead so an explicit empty array can replace inherited values.

Useful? React with 👍 / 👎.

[floze-the-genius]

Fixed in bd7529c. All OverrideRunnerSpec list helpers now distinguish an omitted layer value (nil, inherit repository defaults) from an explicit empty list (replace with empty). Added a regression case covering imagePullSecrets, tolerations, env/envFrom, volumes/mounts, initContainers, command/args, and extra args. Validation: go test ./api/v1alpha1, go vet ./..., and full make test passed; compose services were cleaned up.