Initial implementation: dns-updater daemon

RFC2136 dynamic-DNS updater. Watches a records file (inotify) and new
interface addresses and pushes TSIG-signed updates to BIND per zone, sending
only the delta. Native miekg/dns (structured per-zone RCODEs), local status
API + facter fact, systemd unit, nfpm RPM, Woodpecker CI.

Replaces the puppet dns-update shell script; keeps the same records-file and
TSIG-key contract.

packaging/env.sample

@@ -0,0 +1,24 @@
+# dns-updater configuration (systemd EnvironmentFile).
+# The authoritative write endpoint (BIND primary). Required.
+DNS_UPDATER_SERVER=198.18.200.9
+
+# BIND-style TSIG key file (algorithm + secret). Puppet manages this.
+DNS_UPDATER_KEY_FILE=/etc/dns-updater/key
+
+# Desired records, one per line: zone|name|type|ttl|value. Puppet writes this.
+DNS_UPDATER_RECORDS_FILE=/var/lib/dns-updater/records
+
+# Last-applied state (managed by the daemon).
+DNS_UPDATER_STATE_FILE=/var/lib/dns-updater/applied
+
+# Reconcile on interface address changes (DHCP renew, link reconfig).
+DNS_UPDATER_WATCH_INTERFACES=true
+
+# Periodic safety-net resync (0 disables).
+DNS_UPDATER_RESYNC=10m
+
+# Local status API (unix socket path or host:port; empty disables).
+DNS_UPDATER_API=/run/dns-updater/api.sock
+
+# debug|info|warn|error
+DNS_UPDATER_LOG_LEVEL=info