Initial implementation: dns-updater daemon

RFC2136 dynamic-DNS updater. Watches a records file (inotify) and new
interface addresses and pushes TSIG-signed updates to BIND per zone, sending
only the delta. Native miekg/dns (structured per-zone RCODEs), local status
API + facter fact, systemd unit, nfpm RPM, Woodpecker CI.

Replaces the puppet dns-update shell script; keeps the same records-file and
TSIG-key contract.

packaging/scripts/preremove.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+set -e
+# $1 is 0 on final removal (rpm), "remove" on purge (deb).
+if [ "$1" = "0" ] || [ "$1" = "remove" ] || [ "$1" = "purge" ]; then
+    systemctl disable --now dns-updater.service >/dev/null 2>&1 || true
+fi