docs: template repos are delta overlays, not full account repo scaffolds

Core principle: account repos already carry .tf-control, .tf-control.tfrc,
region.tf, credentials.d/, variables.d/ from initial setup. Template repos
provide only the workload-specific delta (new .tf.j2 files + tf-run.data).

Changes:
- Rewrite template-management.md opening to explain delta-overlay model
  and why duplicating standard files would break reusability
- Minimal real example: template-s3-bucket is 3 files total
- New-layer case: layer-level remote_state.yml provided via EXTRA_FILES
  (Lambda Pydantic model builds it from SC form inputs), not from template
- Remove .tf-control, .tf-control.tfrc, region.tf, credentials.d/,
  variables.d/ from template structure diagram (wrong/environment-specific)
- Remove outdated Lambda template organization section (old EKS-only model)
- Replace stale Executor section (was: renders templates + opens PRs)
  with correct model (runs tf-run apply only, commits lock+symlink back)
- Fix Adding checklist: delta files only + EXTRA_FILES note for new layers