docs(docker): document ccs-net contract for sibling containers (#1259)

Add "Connect your app to CLIProxy" section to docker/README.md with:
- Public contract table (network=ccs-net, service DNS=ccs, ports 8317/3000)
- Pattern A: same compose file with external network reference
- Pattern B: docker run --network ccs-net
- Troubleshooting subsection (DNS, missing network, conflict, Podman, MTU)

Add one-line link in README.md pointing to the new section.
Add CHANGELOG entry under Unreleased noting the contract as SemVer-major stable.
Add CONTRIBUTING.md note that changing services.ccs or networks.ccs-net requires major bump.

.github/workflows/smoke-test-compose-url.yml

@@ -59,3 +59,18 @@ jobs:
 
           echo "[OK] Both ports healthy"
           docker compose -f /tmp/ccs-compose.yaml down -v
+
+      - name: Verify ccs-net network contract (sibling DNS resolution)
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.do_up == true }}
+        run: |
+          set -euo pipefail
+
+          # Checkout repo so tests/docker/network-contract.sh is available
+          # The script needs to run from a directory that contains docker/compose.yaml.
+          # We re-use the compose file from the repo rather than /tmp to avoid path drift.
+          REPO_ROOT="$(mktemp -d)"
+          git clone --depth=1 --no-tags \
+            "https://github.com/kaitranntt/ccs.git" "$REPO_ROOT"
+
+          cd "$REPO_ROOT"
+          bash tests/docker/network-contract.sh