fix: replace SERVICES with TEMPORAL_SERVICES and add service validation

[chaptersix]

Summary

• Replace deprecated SERVICES env var with TEMPORAL_SERVICES in compose/docker-compose-multirole.yaml and tls/tls-full/docker-compose.yml
• Add CI validation to the multirole test job that checks each container is running only its expected service role and that ringpop membership is correctly wired on the internal network

Validation added

Service role isolation — uses /proc/net/tcp inside each container to verify:

• Each service is listening on its expected gRPC port (history→7234, matching→7235, frontend→7237, frontend2→7236)
• No container is binding a port belonging to a different service role

Ringpop membership reachability — for history (6934) and matching (6935):

• Confirms the membership port is listening inside the container
• Confirms the port is reachable cross-container from temporal-admin-tools on temporal-network, verifying ringpop is bound to the right network interface and not just loopback