fix(ci): smoke-test failure check + relax service-key guard (REV9, REV10) (#1276)

REV9 — docker-release.yml smoke-test: add HEALTHY flag to the boot-and-wait
loop. Previously a timeout (status stays 'starting'/'missing' for all 12
iterations) exited the loop silently, letting port probes be the only net.
Now if the loop exits without HEALTHY=1 the step fails immediately with
container logs and state dump. network-contract.sh already has the HEALTHY
pattern — no change needed there.

REV10 — breaking-change-guard.yml: drop the OLD_KEYS != NEW_KEYS comparison.
That check treated ANY change to the service-key set as breaking — including
adding a harmless sidecar. The DNS contract only requires services.ccs to
exist; other services are irrelevant to the 'ccs' hostname on ccs-net. Keep
only the "ccs key must exist" check; remove the unused OLD_KEYS extraction.

.github/workflows/breaking-change-guard.yml

@@ -81,18 +81,15 @@ jobs:
             BREAKING=1
           fi
 
-          # 4. Service key rename — public DNS contract on ccs-net depends on the
-          #    service key being "ccs". Docker's service-name DNS resolves sibling
-          #    containers via the compose service KEY (e.g. http://ccs:8317). A
-          #    rename from "ccs:" to anything else silently breaks every sibling
-          #    container in the wild even when image/network/container_name match.
+          # 4. Service key contract — Docker DNS on ccs-net uses the compose service
+          #    KEY as the hostname (e.g. http://ccs:8317). Renaming or removing
+          #    "ccs:" breaks every sibling container in the wild. Adding new service
+          #    keys (e.g. a sidecar) does NOT affect the "ccs" DNS contract and is
+          #    therefore allowed without a breaking-change marker.
           #
           #    Extraction logic: find lines that look like top-level service keys
           #    (two-space indent + identifier + colon, NOT sub-keys like "image:").
           #    This matches YAML service keys without requiring an external YAML parser.
-          OLD_KEYS=$(git show "${BASE}:docker/compose.yaml" 2>/dev/null \
-            | awk '/^services:/{s=1;next} s && /^  [a-zA-Z0-9_-]+:/{print $1} /^[^ ]/{s=0}' \
-            | tr -d ':' | sort | tr '\n' ' ' | sed 's/ $//')
           NEW_KEYS=$(awk '/^services:/{s=1;next} s && /^  [a-zA-Z0-9_-]+:/{print $1} /^[^ ]/{s=0}' \
             docker/compose.yaml \
             | tr -d ':' | sort | tr '\n' ' ' | sed 's/ $//')
@@ -100,10 +97,6 @@ jobs:
             echo "[!] BREAKING: services.ccs key missing from docker/compose.yaml — sibling containers on ccs-net rely on DNS hostname 'ccs'"
             BREAKING=1
           fi
-          if [[ "${OLD_KEYS}" != "${NEW_KEYS}" ]]; then
-            echo "[!] BREAKING: services keys changed: '${OLD_KEYS}' -> '${NEW_KEYS}'"
-            BREAKING=1
-          fi
 
           echo "breaking=${BREAKING}" >> "$GITHUB_OUTPUT"