dns: deploy dns-updater daemon in place of the shell nsupdate script

Replaces the profiles::dns::updater shell mechanism (dns-update.sh +
dns-update.path/.service + the in-run exec) with the packaged dns-updater
daemon, which watches the records file (inotify) and network interfaces and
pushes TSIG-signed RFC2136 updates natively.

- install the dns-updater package; manage /etc/dns-updater/env
- run the packaged dns-updater.service, restarting only on env/key change
  (records-file edits are picked up by the daemon's own watch, no churn)
- keep the concat records file and TSIG key file unchanged
- ensure the old script + .path/.service units are absent
- drop the now-dead dns-update.{sh,service,path}.epp templates

The daemon reports per-zone RCODEs and a health status API, so failures like
the recent empty-label/NOTZONE ones surface directly instead of as opaque
nsupdate stderr.

site/profiles/templates/dns/dns-update.path.epp

@@ -1,10 +0,0 @@
-<%- | String $records_file | -%>
-[Unit]
-Description=Watch the DNS records file and apply changes
-
-[Path]
-PathModified=<%= $records_file %>
-Unit=dns-update.service
-
-[Install]
-WantedBy=multi-user.target

site/profiles/templates/dns/dns-update.service.epp

@@ -1,9 +0,0 @@
-<%- | String $script | -%>
-[Unit]
-Description=Apply host DNS records via nsupdate
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=oneshot
-ExecStart=<%= $script %>

site/profiles/templates/dns/dns-update.sh.epp

@@ -1,64 +0,0 @@
-<%- | String $server, String $key_file, String $records_file, String $state_file | -%>
-#!/bin/bash
-# Managed by puppet (profiles::dns::updater). Applies this host's records to the
-# authoritative DNS server via TSIG nsupdate. Only the delta since the last
-# successful run is sent; removed records are deleted.
-set -euo pipefail
-
-SERVER="<%= $server %>"
-KEYFILE="<%= $key_file %>"
-RECORDS="<%= $records_file %>"
-STATE="<%= $state_file %>"
-
-[ -f "$RECORDS" ] || exit 0
-touch "$STATE"
-
-# Format per line: zone|name|type|ttl|value  (name is relative to zone, or @).
-desired="$(grep -vE '^[[:space:]]*(#|$)' "$RECORDS" | sort -u || true)"
-applied="$(grep -vE '^[[:space:]]*(#|$)' "$STATE" 2>/dev/null | sort -u || true)"
-
-[ "$desired" = "$applied" ] && exit 0
-
-fqdn() { # name zone
-  # $1 may be relative to the zone, "@"/empty for the apex, or already a FQDN
-  # (trailing dot). Only append the zone in the relative case; appending it to
-  # an already-qualified name yields a "..", which nsupdate rejects as an
-  # "invalid owner name: empty label".
-  case "$1" in
-    ''|'@') printf '%s.' "$2" ;;
-    *.)     printf '%s' "$1" ;;
-    *)      printf '%s.%s.' "$1" "$2" ;;
-  esac
-}
-
-msg="$(mktemp)"
-trap 'rm -f "$msg"' EXIT
-printf 'server %s\n' "$SERVER" >> "$msg"
-
-# Process per zone so each UPDATE message targets a single zone.
-zones="$(printf '%s\n%s\n' "$desired" "$applied" | cut -d'|' -f1 | sort -u | grep -v '^$' || true)"
-for zone in $zones; do
-  printf 'zone %s.\n' "$zone" >> "$msg"
-  # Additions/updates: replace the RRset for every desired record in this zone.
-  printf '%s\n' "$desired" | awk -F'|' -v z="$zone" 'NF>=5 && $1==z' | \
-    while IFS='|' read -r z name type ttl value; do
-      f="$(fqdn "$name" "$z")"
-      printf 'update delete %s %s\n' "$f" "$type" >> "$msg"
-      printf 'update add %s %s %s %s\n' "$f" "$ttl" "$type" "$value" >> "$msg"
-    done
-  # Deletions: records present last run but gone now.
-  comm -23 <(printf '%s\n' "$applied") <(printf '%s\n' "$desired") | \
-    awk -F'|' -v z="$zone" 'NF>=5 && $1==z' | \
-    while IFS='|' read -r z name type ttl value; do
-      f="$(fqdn "$name" "$z")"
-      printf 'update delete %s %s %s\n' "$f" "$type" "$value" >> "$msg"
-    done
-  printf 'send\n' >> "$msg"
-done
-
-if nsupdate -k "$KEYFILE" "$msg"; then
-  printf '%s\n' "$desired" > "$STATE"
-else
-  echo "dns-update: nsupdate to ${SERVER} failed" >&2
-  exit 1
-fi