haproxy::dns: fully-qualify halb CNAME targets (#489)

## Why

The halb publishes service CNAMEs (`git.unkin.net`, `dashboard.ceph.unkin.net`, and every other halb-fronted name) with a **bare target label**, e.g.:
```
git.unkin.net.  300  IN  CNAME  au-syd1-prod-halb-vrrp.
```
`dns-updater` builds the RR with `dns.NewRR` and **no $ORIGIN**, so a bare value becomes root-absolute (`au-syd1-prod-halb-vrrp.`) and dead-ends in NXDOMAIN. Once the k8s bind became authoritative for these zones, that broke resolution of every halb-fronted service (git, the Ceph dashboard, ...). `au-syd1-prod-halb-vrrp.unkin.net` / `.main.unkin.net` resolve fine (198.18.19.17) — only the CNAME target was truncated.

## Change (`site/profiles/manifests/haproxy/dns.pp`)

Emit **fully-qualified** CNAME targets (trailing dot), the FQDN form `dns-updater` expects (per its own test fixture `au-syd1-prod-halb.main.unkin.net.`):
- vrrp cnames: `${location_environment}-halb-vrrp.${domain}.`
- non-vrrp cnames: `${location_environment}-halb.${domain}.`

The matching A records are already published in `main.unkin.net`/`unkin.net` just above, so the targets resolve to the VIP.

---------

Co-authored-by: benvin <neotheo@gmail.com>
Reviewed-on: #489
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

site/profiles/manifests/haproxy/dns.pp

@@ -21,7 +21,10 @@ class profiles::haproxy::dns (
     $parts = split($cname, '\.')
     $domain = join($parts[1, $parts.length], '.')
     profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
-      value  => "${location_environment}-halb",
+      # CNAME target must be a fully-qualified name (trailing dot): dns-updater
+      # parses the value with no $ORIGIN, so a bare label becomes root-absolute
+      # ("au-syd1-prod-halb.") and dead-ends in NXDOMAIN.
+      value  => "${location_environment}-halb.${facts['networking']['domain']}.",
       type   => 'CNAME',
       record => "${cname}.",
       zone   => $domain,
@@ -58,7 +61,10 @@ class profiles::haproxy::dns (
         $parts = split($cname, '\.')
         $domain = join($parts[1, $parts.length], '.')
         profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
-          value  => "${location_environment}-halb-vrrp",
+          # Fully-qualified target (trailing dot); see the note on the non-vrrp
+          # cnames above. The matching A record is published in main.unkin.net
+          # and unkin.net just above.
+          value  => "${location_environment}-halb-vrrp.${facts['networking']['domain']}.",
           type   => 'CNAME',
           record => "${cname}.",
           zone   => $domain,