Initial implementation: dns-updater daemon

RFC2136 dynamic-DNS updater. Watches a records file (inotify) and new
interface addresses and pushes TSIG-signed updates to BIND per zone, sending
only the delta. Native miekg/dns (structured per-zone RCODEs), local status
API + facter fact, systemd unit, nfpm RPM, Woodpecker CI.

Replaces the puppet dns-update shell script; keeps the same records-file and
TSIG-key contract.

packaging/scripts/postinstall.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+set -e
+systemctl daemon-reload >/dev/null 2>&1 || true
+# Restart if already enabled/running; otherwise leave it for puppet to enable
+# once the TSIG key and records file are in place.
+if systemctl is-enabled dns-updater.service >/dev/null 2>&1; then
+    systemctl try-restart dns-updater.service >/dev/null 2>&1 || true
+fi

packaging/scripts/preremove.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+set -e
+# $1 is 0 on final removal (rpm), "remove" on purge (deb).
+if [ "$1" = "0" ] || [ "$1" = "remove" ] || [ "$1" = "purge" ]; then
+    systemctl disable --now dns-updater.service >/dev/null 2>&1 || true
+fi