dns: dual-write toggles + drift fact

Publish records both ways during the k8s cutover, and expose expected vs
deployed records for drift detection.

- profiles::dns::updater + ::record: manage_nsupdate and manage_export
  booleans (both default on); export keeps the legacy master flow, so
  disable it once k8s is authoritative
- dns_records fact: parses the expected records file and digs the
  authoritative server for each, reporting expected / in_sync / drift
  (plus dns_records_insync boolean); updater writes the server address
  to /var/lib/dns-updater/server for the fact
- hiera: manage_export/manage_nsupdate = true (cutover)

hieradata/common.yaml

@@ -146,6 +146,8 @@ lookup_options:
       strategy: deep
   profiles::etcd::node::initial_cluster_token:
     convert_to: Sensitive
+  profiles::dns::updater::key_secret:
+    convert_to: Sensitive
   sysctl::base::values:
     merge:
       strategy: deep