infra(l1): enable validatorOnly read-privacy for a production BenzoNet

[akash-mondal]

Tracker: #154

Context

BenzoNet ships with the validatorOnly RPC read-restriction intentionally OFF so the public demo (rpc.benzo.space, explorer.benzo.space) stays publicly verifiable (README.md "What is Real vs. Simulated"). A production institutional deployment enables it — that is the read-privacy half of the permissioned-chain story (the tx-allowlist precompile 0x0200000000000000000000000000000000000002 already gates who can transact).

Scope

• Document the public-vs-restricted read tradeoff and which surfaces break when validatorOnly is ON (public explorer, external indexers, the backend activity indexer Receipts/activity indexer: poll eERC events, ciphertexts opaque, client-side decryption contract #44).
• Plan a gated public read path: an authenticated/permissioned RPC or indexer that serves reads while the raw RPC is validator-restricted.
• Define the exact config flip (genesis / subnet config) and a separate "institutional" BenzoNet profile vs. the public demo profile.

Acceptance criteria

• A written tradeoff analysis + list of surfaces affected by validatorOnly.
• A design for a permissioned read path so encrypted-amount privacy + gated reads coexist with an operable explorer/indexer.
• The exact change to enable validatorOnly documented (not applied to the public demo).

Dependencies

• Interacts with the Blockscout explorer (Stand up a token-gated Blockscout explorer for BenzoNet #29) and the activity indexer (Receipts/activity indexer: poll eERC events, ciphertexts opaque, client-side decryption contract #44).
• Pairs with the multi-validator issue for a coherent "production BenzoNet" profile.