haproxy::dns: fully-qualify halb CNAME targets

The halb published service CNAMEs (git.unkin.net, dashboard.ceph.unkin.net, ...)
with a bare target label ("au-syd1-prod-halb-vrrp"). dns-updater parses the
record value with no $ORIGIN, so a bare label becomes root-absolute
("au-syd1-prod-halb-vrrp.") and dead-ends in NXDOMAIN -- breaking every
halb-fronted name once the k8s bind became authoritative.

Emit fully-qualified targets (trailing dot) for both the vrrp and non-vrrp
CNAMEs, matching the FQDN value dns-updater expects:
- au-syd1-prod-halb-vrrp.<domain>. and au-syd1-prod-halb.<domain>.

site/profiles/manifests/haproxy/dns.pp

@@ -21,7 +21,10 @@ class profiles::haproxy::dns (
     $parts = split($cname, '\.')
     $domain = join($parts[1, $parts.length], '.')
     profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
-      value  => "${location_environment}-halb",
+      # CNAME target must be a fully-qualified name (trailing dot): dns-updater
+      # parses the value with no $ORIGIN, so a bare label becomes root-absolute
+      # ("au-syd1-prod-halb.") and dead-ends in NXDOMAIN.
+      value  => "${location_environment}-halb.${facts['networking']['domain']}.",
       type   => 'CNAME',
       record => "${cname}.",
       zone   => $domain,
@@ -58,7 +61,10 @@ class profiles::haproxy::dns (
         $parts = split($cname, '\.')
         $domain = join($parts[1, $parts.length], '.')
         profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
-          value  => "${location_environment}-halb-vrrp",
+          # Fully-qualified target (trailing dot); see the note on the non-vrrp
+          # cnames above. The matching A record is published in main.unkin.net
+          # and unkin.net just above.
+          value  => "${location_environment}-halb-vrrp.${facts['networking']['domain']}.",
           type   => 'CNAME',
           record => "${cname}.",
           zone   => $domain,