dns: stop exporting legacy DNS fragments (manage_export false)

Clients now resolve via the k8s bind (198.18.200.7) which serves the
authoritative zones fed by the nsupdate path, so the legacy
exported-resource -> VM-master /var/named/sources files are no longer in
the serving path. Turn off the export half of the dual-write; the
nsupdate (manage_nsupdate) half stays on.

hieradata/common.yaml

@@ -219,7 +219,13 @@ profiles::dns::master::basedir: '/var/named/sources'
 #                 profiles::dns::updater::key_secret: ENC[...]
 #               (must match the key the bind-authoritative zones allow-update
 #               with; algorithm hmac-sha256)
-profiles::dns::updater::manage_export: true
+# k8s is now authoritative: clients resolve via the k8s bind-resolvers
+# (profiles::dns::base::nameservers 198.18.200.7, since #490), which forward the
+# unkin.net/main.unkin.net/*.18.198.in-addr.arpa zones to the k8s
+# bind-authoritative cluster fed by the nsupdate path below. The legacy
+# exported-resources -> VM-master /var/named/sources files are no longer in any
+# client's resolution path, so stop exporting them. Rollback: set back to true.
+profiles::dns::updater::manage_export: false
 profiles::dns::updater::manage_nsupdate: true
 profiles::dns::updater::server: '198.18.200.9'
 profiles::dns::updater::key_name: 'client-update'