fix(ci): smoke through service namespace (#1)

docs/deployment/linux.md

@@ -49,14 +49,14 @@ Compose, then point `RENDEZVOUS_SMOKE_HTTP_URL` and
 and production-advertised service ports remain 8080/9050. Sibling-container CI
 runners may also set `RENDEZVOUS_CONFIG_SOURCE` and
 `RENDEZVOUS_SECRET_SOURCE` to host-visible absolute bind-source paths; local
-operators should normally keep the checked-in relative defaults. CI starts its
-ephemeral smoke client directly on the isolated Compose network; it does not
-widen the default loopback HTTP publication. It mints the disposable publisher
-credential while the generated key is still owner-private, then makes the key
-read-only for the non-root service container. Automation probes readiness once
-per second and allows up to three minutes for a cold, resource-constrained image
-to become ready; the protocol smoke retains its separate, stricter scenario
-timeout.
+operators should normally keep the checked-in relative defaults. CI runs its
+ephemeral smoke client as a sidecar in the service container's network namespace
+to avoid runner-specific bridge and host-routing policy; it does not widen the
+default loopback HTTP publication. It mints the disposable publisher credential
+while the generated key is still owner-private, then makes the key read-only for
+the non-root service container. Automation probes readiness once per second and
+allows up to three minutes for a cold, resource-constrained image to become
+ready; the protocol smoke retains its separate, stricter scenario timeout.
 
 `deploy/compose/appsettings.Production.json` is a local/private-bridge smoke
 profile, not an Internet template: TCP is published only on host loopback, the