feat(dns): govern unattended provider automation

[dviejokfs]

Summary

• add a fail-closed policy boundary for unattended ACME DNS-01 record publication
• add dedicated DNS provider read, write, and automation permissions for roles and API keys
• add durable audit events for provider, managed-domain, authorization, and publication outcomes
• route previously captured audit clients through later audit decorators

Security properties

• missing policy registration denies unattended DNS changes
• provider operations are derived directly from the authorized TXT mutation request
• only exact ACME challenge records inside the resolved zone reach the mutation boundary
• denial and policy-error paths leave the DNS provider untouched

Evidence

Workspace validation

cargo check --lib -p temps-core -p temps-audit -p temps-auth -p temps-dns -p temps-domains
cargo clippy --lib -- -D warnings

Results: 0 errors.

Authorization and mutation boundary

cargo test --lib -p temps-core dns_automation
cargo test --lib -p temps-core captured_trait_object_routes_to_replacement
cargo test --lib -p temps-auth dns_governance_permissions
cargo test --lib -p temps-domains denied_automation
cargo test --lib -p temps-domains authorization_error_does_not_touch_provider
cargo test --lib -p temps-domains allowed_automation
cargo test --lib -p temps-domains partial_publish_failure

Results: 9 passed, 0 failed across the focused runs.

Real ACME DNS-01 validation

cargo test --lib -p temps-domains test_provision_dns01_wildcard_real_pebble -- --nocapture

Result: 1 passed, 0 failed in 11.21s.

[github-actions]

📓 Changelog preview

This is what your commits will add to the generated CHANGELOG.md at release time (via git-cliff). Do not edit CHANGELOG.md by hand — it is generated from your Conventional Commit messages.

## [Unreleased]

### Added

- **dns:** Govern unattended provider automation