dns: dual-write toggles + drift fact

Publish records both ways during the k8s cutover, and expose expected vs
deployed records for drift detection.

- profiles::dns::updater + ::record: manage_nsupdate and manage_export
  booleans (both default on); export keeps the legacy master flow, so
  disable it once k8s is authoritative
- dns_records fact: parses the expected records file and digs the
  authoritative server for each, reporting expected / in_sync / drift
  (plus dns_records_insync boolean); updater writes the server address
  to /var/lib/dns-updater/server for the fact
- hiera: manage_export/manage_nsupdate = true (cutover)

site/profiles/manifests/dns/record.pp

@@ -1,9 +1,10 @@
 # profiles::dns::record
 #
-# Declares a DNS record for this host. The record is written to the local
-# dns-updater records file (profiles::dns::updater), which nsupdates it to the
-# authoritative DNS server. This replaces the old flow that exported a
-# @@concat::fragment to the puppet DNS master.
+# Declares a DNS record for this host. Publishes it via either or both methods,
+# controlled by profiles::dns::updater's toggles (both on during cutover):
+#   - nsupdate: a local concat fragment consumed by profiles::dns::updater,
+#     which nsupdates it to the authoritative server.
+#   - export: the legacy @@concat::fragment exported to the puppet DNS master.
 define profiles::dns::record (
   String  $record,
   Enum[
@@ -22,10 +23,22 @@ define profiles::dns::record (
 ) {
   include profiles::dns::updater
 
-  # zone|name|type|ttl|value  (parsed by the dns-update script)
-  concat::fragment { "dns-record-${name}":
-    target  => $profiles::dns::updater::records_file,
-    content => "${zone}|${record}|${type}|${ttl}|${value}\n",
-    order   => sprintf('%03d', $order),
+  # new: local records file consumed by the nsupdate service
+  if $profiles::dns::updater::manage_nsupdate {
+    # zone|name|type|ttl|value  (parsed by the dns-update script)
+    concat::fragment { "dns-record-${name}":
+      target  => $profiles::dns::updater::records_file,
+      content => "${zone}|${record}|${type}|${ttl}|${value}\n",
+      order   => sprintf('%03d', $order),
+    }
+  }
+
+  # legacy: export the fragment to the puppet DNS master
+  if $profiles::dns::updater::manage_export {
+    @@concat::fragment { "${zone}_${name}":
+      target  => "${profiles::dns::updater::master_basedir}/${zone}.conf",
+      content => "${record} IN ${type} ${value}\n",
+      order   => $order,
+    }
   }
 }