Add manual bump workflow for dnscrypt-proxy

[klutchell]

Summary

Replaces Renovate-driven auto-bumps of DNSCrypt/dnscrypt-proxy with a manual maintainer workflow, modeled on the existing process in klutchell/unbound-docker.

Why

Renovate-only bumps have two gaps:

1. No source integrity check. The Dockerfile fetched https://github.com/DNSCrypt/dnscrypt-proxy/archive/${VERSION}.tar.gz with no SHA256 verification — a silent supply-chain risk if GitHub's archive endpoint ever served unexpected bytes.
2. No example-config regeneration. This image bundles config/example-* files extracted from the upstream source via the conf-example build stage. Renovate's bumps only updated ARG DNSCRYPT_PROXY_VERSION and never re-ran the extraction, so the bundled examples drifted from the actually-pinned upstream. The most user-visible drift: example-dnscrypt-proxy.toml on main was still documenting the removed tls_cipher_suite option from earlier 2.1.x releases, even though upstream replaced it with tls_prefer_rsa.

What changes

• Dockerfile — pins DNSCRYPT_PROXY_SHA256 for 2.1.16 and verifies it with sha256sum -c before extracting the tarball. Builds now fail fast if the upstream archive bytes change unexpectedly.
• .github/renovate.json — explicit packageRules entry disabling Renovate for DNSCrypt/dnscrypt-proxy (so a future contributor doesn't "fix" the missing renovate marker by re-enabling it). The renovate marker comment has also been removed from the Dockerfile.
• CONTRIBUTING.md — new file documenting build/test/bump/tag processes, matching the structure of unbound-docker's.
• config/example-* — regenerated from upstream 2.1.16 via docker build . --target conf-example --output ./config. Brings the bundled examples back in sync with the pinned upstream version.

The actual 2.1.16 version bump landed in #646; this PR is the workflow infrastructure that future X.Y.Z bumps will use. v2.1.16 has been tagged on the content commit as part of putting this workflow into practice.

Test plan

• docker build . --tag klutchell/dnscrypt-proxy:dev succeeds with SHA256 verification active
• docker run --rm klutchell/dnscrypt-proxy:dev --version prints 2.1.16
• Build with a deliberately-wrong SHA256 fails at the verification step (exit 1) — confirms the check actually rejects mismatches
• docker build . --target conf-example --output ./config regenerates example files cleanly
• Pre-commit hooks pass (hadolint, renovate-config-validator, trailing-whitespace, end-of-file-fixer)
• CI passes the full integration suite in docker-compose.test.yml