Add service contract enforcement workflow

[crypt0rr]

What changed

• Add tools/validate_services.py with text, GitHub annotation, and JSON output for deterministic service-contract enforcement.
• Add explicit sidecar-web, multi-container, and tailscale-node profiles in tools/service-profiles.yml.
• Add the required changed-service GitHub workflow, Compose config checks, validator fixtures, and Python dependency pin.
• Update the contributor guide, service template, PR template, issue forms, and repository ignore rules.
• Record the current baseline audit and remediation backlog.

The personal scaletail-maintainer Codex skill is installed outside the repository at ~/.codex/skills/scaletail-maintainer and is intentionally not part of this PR.

Why

ScaleTail service directories need a deterministic contract so new services and service changes preserve the Tailscale sidecar topology, template comments, documentation, Compose validity, and secret-safety rules. Research-heavy upstream behavior remains a maintainer workflow rather than an automated runtime test.

Validation

• python -m unittest discover -s tools/tests -v — 9 tests passed.
• Python compilation passed.
• YAML parsing passed for the workflow, profiles, and issue forms.
• git diff --check passed.
• Skill validation passed.
• Baseline audit: 658 findings (650 warnings, 8 known blocking errors).
• Compose audit: 118/120 services pass; the known failures are Dockge's empty STACKS_DIR bind mount and NetBox's invalid /.env reference, plus the documented ingress health-dependency backlog.

No images were pulled and no containers were started by the validator or CI workflow.