Wait for HA peer DNS before starting kea-dhcp4

## Why
kea-dhcp4 crash-loops on a cold container start: the HA hook resolves the StatefulSet peer URL hostnames once at config load, but the peer DNS records are not resolvable in the first moment of a fresh container, and kea exits hard instead of retrying (HA_CONFIGURATION_FAILED / "Failed to convert string to address"). Once DNS is warm the exact config validates, so the failure is purely a startup race.

## How
- gate the dhcp4 entrypoint on `kea-dhcp4 -t` and retry until the config validates before exec'ing the server

internal/kea/config_test.go

@@ -249,6 +249,17 @@ func TestEntrypointsHardenSocketDir(t *testing.T) {
 	}
 }
 
+func TestEntrypointWaitsForConfigToValidate(t *testing.T) {
+	// The dhcp4 entrypoint must gate startup on `kea-dhcp4 -t` so a cold-start
+	// HA peer DNS resolution failure retries instead of crash-looping.
+	ep := EntrypointDHCP4()
+	for _, want := range []string{"until " + DHCP4Bin + " -t " + DHCP4ConfPath, "exec " + DHCP4Bin + " -c " + DHCP4ConfPath} {
+		if !strings.Contains(ep, want) {
+			t.Errorf("dhcp4 entrypoint must contain %q, got:\n%s", want, ep)
+		}
+	}
+}
+
 func TestControlSocketPathAllowedByKea(t *testing.T) {
 	if !strings.HasPrefix(CtrlSocketPath, "/var/run/kea/") {
 		t.Errorf("CtrlSocketPath %q must live under /var/run/kea (kea 2.6+ restriction)", CtrlSocketPath)