Migrates the 18 zones served by the puppet authoritative masters
(profiles::dns::master::zones) as BindZone CRs on the auth cluster:
unkin.net, main.unkin.net, and the 198.18.{13-29}.0/24 reverse zones.
- add apps/base/ns-auth/zones.yaml (type primary, TTL 600); records are
migrated separately (not stored in puppet, generated via PuppetDB)
