fix: tighten parity check + catch service-key rename (#1261 loop 3) (#1274)

* fix(test): tighten compose-parity image-name match to exact expected values (REV7)

Replace loose substring grep (grep -q "ccs") with exact equality checks
against declared EXPECTED_CANONICAL_IMAGE and EXPECTED_INTEGRATED_IMAGE
constants. The integrated compose builds locally as ccs-cliproxy:latest
(not ghcr.io/kaitranntt/ccs), so both expected names are explicitly
documented at the top of the assertion block.

Fixes: a drift in integrated compose to a wrong owner/registry could
slip through the old "grep -q ccs" check; now any name other than the
declared constant is a hard failure.

* feat(ci): breaking-change-guard catches services.ccs rename — public DNS contract (REV8)

Docker's service-name DNS uses the compose service KEY as the hostname.
Sibling containers on ccs-net reach CCS via http://ccs:8317; renaming
services.ccs: to anything else silently breaks that contract even when
image name, network name, and container_name are unchanged.

Add check 4 to the guard:
- Extract top-level service keys from both base and HEAD versions of
  docker/compose.yaml using awk (no external YAML parser required).
- Fail if the "ccs" key is absent from HEAD.
- Fail if the sorted set of service keys differs from base.

Wraps inside the existing git cat-file guard so new-file PRs skip it.

tests/docker/compose-parity.sh

@@ -65,19 +65,37 @@ volume_targets() {
 }
 
 # ---------------------------------------------------------------------------
-# 1. Image name (repo without tag) — both should reference kaitranntt/ccs
+# Expected image names (without tag) — source of truth for this assertion.
+#
+# canonical (docker/compose.yaml):
+#   Pulls from the public registry. Default image is ghcr.io/kaitranntt/ccs.
+#
+# integrated (docker/docker-compose.integrated.yml):
+#   Built locally from Dockerfile.integrated; the resulting image is tagged
+#   ccs-cliproxy (no registry prefix) so it stays separate from the public
+#   image but is still clearly a CCS-family image.
+# ---------------------------------------------------------------------------
+EXPECTED_CANONICAL_IMAGE="ghcr.io/kaitranntt/ccs"
+EXPECTED_INTEGRATED_IMAGE="ccs-cliproxy"
+
+# ---------------------------------------------------------------------------
+# 1. Image name (repo without tag) — assert exact match against expected names
 # ---------------------------------------------------------------------------
 log "Checking image name parity..."
 
 CANONICAL_IMAGE=$(image_name "$CANONICAL" "ccs")
 INTEGRATED_IMAGE=$(image_name "$INTEGRATED" "ccs-cliproxy")
 
-# Both must contain kaitranntt/ccs (integrated builds locally but from the same Dockerfile)
-if echo "$CANONICAL_IMAGE" | grep -q "kaitranntt/ccs" && \
-   echo "$INTEGRATED_IMAGE" | grep -q "ccs"; then
-  ok "Image names reference expected repo (canonical: ${CANONICAL_IMAGE}, integrated: ${INTEGRATED_IMAGE})"
+if [[ "${CANONICAL_IMAGE}" != "${EXPECTED_CANONICAL_IMAGE}" ]]; then
+  fail "Canonical image name mismatch — expected='${EXPECTED_CANONICAL_IMAGE}' got='${CANONICAL_IMAGE}'"
 else
-  fail "Image name mismatch — canonical='${CANONICAL_IMAGE}' integrated='${INTEGRATED_IMAGE}'"
+  ok "Canonical image name matches expected (${CANONICAL_IMAGE})"
+fi
+
+if [[ "${INTEGRATED_IMAGE}" != "${EXPECTED_INTEGRATED_IMAGE}" ]]; then
+  fail "Integrated image name mismatch — expected='${EXPECTED_INTEGRATED_IMAGE}' got='${INTEGRATED_IMAGE}'"
+else
+  ok "Integrated image name matches expected (${INTEGRATED_IMAGE})"
 fi
 
 # ---------------------------------------------------------------------------