docs(contributing): document fast/container test split and tox dev-headers

Two CONTRIBUTING additions to match the current test layout:

- "Running tests" now explains the fast vs container split, documents
  the `--no-container` / `--only-container` flags and
  `tools/run-container-tests`, and notes that `tox` runs the fast
  suite via `tools/run-unit-tests --no-container`.
- Add a dev-headers note: `linuxfabrik-lib` pulls in `netifaces`,
  which has no binary wheels on PyPI, so every Python version used in
  the `tox` matrix needs the matching `pythonX.Y-devel` /
  `pythonX.Y-dev` package installed on the host. Without that, pip
  falls back to building `netifaces` from source and aborts with
  `fatal error: Python.h: No such file or directory`.

Author: markuslf

CHANGELOG.md

@@ -63,6 +63,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * CONTRIBUTING: add README structure guidelines with fixed section order, Fact Sheet template, and Nagios/Icinga check name for SEO
 * CONTRIBUTING: remove inline `pylint: disable` comments from code examples
 * CONTRIBUTING: require Nagios range support (`type=str`, `_operator='range'`) for threshold parameters in new plugins ([#1067](https://github.com/Linuxfabrik/monitoring-plugins/issues/1067))
+* CONTRIBUTING: document the fast-vs-container unit test split, the new `--no-container` / `--only-container` flags on `tools/run-unit-tests`, the `tools/run-container-tests` wrapper, and the `pythonX.Y-devel` system packages needed locally for `tox` to build `netifaces` from source under each matrix interpreter
 * CONTRIBUTING: rewrite unit test fixture naming convention - fixtures in `stdout/` are named by scenario (e.g. `cpu-80-percent`), the expected state is encoded in the testcase `id` instead, so a single fixture can be reused by multiple testcases that vary plugin parameters to reach different states
 * CONTRIBUTING: rewrite unit-test section with declarative test pattern, naming conventions, and tox usage
 * CONTRIBUTING: run pylint without `--disable` flags

CONTRIBUTING.md

@@ -802,6 +802,13 @@ Available assertion keys in each testcase dict:
 
 #### Running tests
 
+Unit tests come in two flavors:
+
+* **Fast tests** use `--test` to inject fixture data and run in a fraction of a second. They are safe for CI and for the multi-Python-version `tox` matrix.
+* **Container tests** build a podman image per target OS, inject the plugin and `lib/`, and exercise the check against a live service. They need podman on the host and take minutes per plugin. A plugin counts as a container test when its `unit-test/` directory has a `containerfiles/` subdirectory.
+
+Everyday commands:
+
 ```bash
 # single plugin (from its unit-test directory)
 cd check-plugins/my-check/unit-test
@@ -810,13 +817,40 @@ cd check-plugins/my-check/unit-test
 # single plugin (from the repo root)
 python tools/run-unit-tests my-check
 
-# all plugins
+# all plugins (fast + container)
 python tools/run-unit-tests
 
-# all plugins across multiple Python versions (via tox)
-tox
+# only the fast tests (used by tox)
+python tools/run-unit-tests --no-container
+
+# only the container tests (also available as a thin wrapper)
+python tools/run-unit-tests --only-container
+python tools/run-container-tests
+```
+
+Multi-Python coverage via `tox`:
+
+```bash
+tox                      # all supported Python versions, fast tests only
+tox -e py39              # single environment
 ```
 
+`tox` invokes `tools/run-unit-tests --no-container` so the multi-Python matrix skips the container suite. Run `tools/run-container-tests` separately before a release for full integration coverage.
+
+`tox` builds each Python environment from sdist, and `linuxfabrik-lib` pulls in `netifaces` which has no binary wheels on PyPI. For every Python version in the `tox` matrix you want to run locally, the matching development headers must be installed on the host, otherwise pip falls back to building `netifaces` from source and aborts with `fatal error: Python.h: No such file or directory`:
+
+```bash
+# Fedora
+sudo dnf install python3.9-devel python3.10-devel python3.11-devel \
+                 python3.12-devel python3.13-devel python3.14-devel
+
+# Debian / Ubuntu
+sudo apt install python3.9-dev python3.10-dev python3.11-dev \
+                 python3.12-dev python3.13-dev python3.14-dev
+```
+
+`skip_missing_interpreters = true` already skips environments for Python versions that are not installed at all.
+
 
 #### Container-based tests
 
@@ -825,6 +859,7 @@ If you want to implement unit tests based on containers, the following rules app
 * Each container file does everything necessary to set up a running environment for the check plugin (e.g. install Python if you want to run the plugin inside the container).
 * The `./run` unit test simply calls podman and, for each containerfile found, builds the container, injects the libs and the check plugin, and runs the tests - but does not modify the container in any other way.
 * See the `keycloak-version` plugin for how to do this.
+* `tools/run-unit-tests` auto-detects container tests by looking for a `containerfiles/` subdirectory, so `--no-container` / `--only-container` filter correctly without any per-plugin annotation.
 
 
 ### sudoers File