fix(ci): smoke-test failure check + relax service-key guard (REV9, REV10) (#1276)

REV9 — docker-release.yml smoke-test: add HEALTHY flag to the boot-and-wait
loop. Previously a timeout (status stays 'starting'/'missing' for all 12
iterations) exited the loop silently, letting port probes be the only net.
Now if the loop exits without HEALTHY=1 the step fails immediately with
container logs and state dump. network-contract.sh already has the HEALTHY
pattern — no change needed there.

REV10 — breaking-change-guard.yml: drop the OLD_KEYS != NEW_KEYS comparison.
That check treated ANY change to the service-key set as breaking — including
adding a harmless sidecar. The DNS contract only requires services.ccs to
exist; other services are irrelevant to the 'ccs' hostname on ccs-net. Keep
only the "ccs key must exist" check; remove the unused OLD_KEYS extraction.

.github/workflows/docker-release.yml

@@ -342,10 +342,12 @@ jobs:
             "${{ steps.image.outputs.ref }}"
 
           echo "[i] Waiting for container healthcheck (up to 60s)..."
+          HEALTHY=0
           for i in $(seq 1 12); do
             STATUS=$(docker inspect "${CONTAINER_NAME}" --format='{{.State.Health.Status}}' 2>/dev/null || echo "missing")
             if [[ "${STATUS}" == "healthy" ]]; then
               echo "[OK] Container is healthy after $((i * 5))s"
+              HEALTHY=1
               break
             fi
             if [[ "${STATUS}" == "unhealthy" ]]; then
@@ -356,6 +358,12 @@ jobs:
             echo "    [${i}/12] status=${STATUS}, waiting 5s..."
             sleep 5
           done
+          if [[ "${HEALTHY}" -ne 1 ]]; then
+            echo "[X] Container did not become healthy within 60s (last status: ${STATUS})" >&2
+            docker logs "${CONTAINER_NAME}" --tail 100 >&2
+            docker inspect "${CONTAINER_NAME}" --format='{{json .State}}' >&2 || true
+            exit 1
+          fi
 
       - name: Run network-contract test
         run: |