feat: DEP-0003 verified record withdrawal before address reuse (#17)

* docs: design verify-only external DNS provider

* feat(core): support credentialless DNS providers

Make ZoneClass identityRef optional with Provider-version admission, preserve projected condition messages, gate cloud registrations and privileges, and support credentialless ZoneClass UI creation. Regenerate deepcopy and both CRD distributions; add deterministic admission, projection, chart and UI regressions.

Contract: dns-api PR #15 / 99d0753 docs/design/external-provider.md (ZoneClass Parameters, Conditions and Public Data, Packaging), core-api.md, provider-extension.md, controllers-webhooks.md (Provider Enablement), ui.md (Zone Classes), and test-policy.md. Platform PR #5331 / cd995cf0ed design/platform/onprem/README.md sections 4.3, 4.4 step 4, 4.7, and Phase 4.

Codegen: devbox run -- task generate manifests controller-chart:sync-crds completed. Tests, builds, linters and UI typecheck intentionally deferred to the primary integration agent.

* feat(external): verify-only DNS provider

Provider external.dns.appthrust.io/v1alpha1 (A/AAAA/CNAME, no identity), ZoneClass resolver policy and expectedNameservers, exact-set A/AAAA verification with bounded CNAME chains and wildcard witnesses, Cluster/Recursive views plus RD=0 authority checks, bounded scheduling (30-300s, jitter, backoff, 32 names/pass, 40 QPS/80 burst), UID/generation/policy-bound receipts, bookkeeping-only deletion, endpoint conversion handler, metrics. Design: docs/design/external-provider.md.

* fix(external): avoid unchanged scheduler status patches

* docs: trim trailing blank line

* Wire external DNS provider into manager and deployment packaging

* fix(external): describe every array item in the Provider schemas so core admission accepts the manifest

The core webhook requires a description on every property and array item; the external Provider was rejected on install. The built-in-manifest validation test now covers external_extensions.yaml.

* docs: DEP-0003 RecordWithdrawal — verified DNS withdrawal before address reuse (Draft)

* docs: DEP-0003 ZoneUnit withdrawal items keyed by claimNamespace/claimName

* feat(api): define retained DNS withdrawal and retirement contracts

* feat(api): fence withdrawal results to ZoneClass incarnation and generation

* feat(core): compose and project verified DNS withdrawal claims

* feat(external): verify DNS withdrawal before retired address reuse

* feat(endpoint): capture retired DNS pairs before source deletion

* fix(core): preserve admission parity and existing Zone deletion messages

* docs: accept DEP-0003 and reflect verified record withdrawal into docs/design

Author: reoring

app/operator/config/crd/bases/dns.appthrust.io_providers.yaml

@@ -120,6 +120,9 @@ spec:
                                 enum:
                                 - Accepted
                                 - Programmed
+                                - Withdrawn
+                                - Ready
+                                - OverrideAccepted
                                 type: string
                               description:
                                 description: Description explains when the provider-specific
@@ -304,6 +307,67 @@ spec:
                             type: object
                           type: array
                       type: object
+                    recordWithdrawal:
+                      description: RecordWithdrawal declares support for independent
+                        exclusion verification.
+                      properties:
+                        additionalConditionReasons:
+                          items:
+                            properties:
+                              conditionType:
+                                description: ConditionType is the status condition
+                                  type this reason applies to.
+                                enum:
+                                - Accepted
+                                - Programmed
+                                - Withdrawn
+                                - Ready
+                                - OverrideAccepted
+                                type: string
+                              description:
+                                description: Description explains when the provider-specific
+                                  reason is used.
+                                minLength: 1
+                                type: string
+                              reason:
+                                description: Reason is the provider-specific condition
+                                  reason stored in metav1.Condition.reason.
+                                minLength: 1
+                                pattern: ^[A-Z][A-Za-z0-9]*$
+                                type: string
+                              status:
+                                description: Status is the condition status this reason
+                                  applies to.
+                                enum:
+                                - "True"
+                                - "False"
+                                - Unknown
+                                type: string
+                            required:
+                            - conditionType
+                            - description
+                            - reason
+                            - status
+                            type: object
+                          type: array
+                        schemas:
+                          properties:
+                            statusProviderData:
+                              description: StatusProviderData validates public withdrawal
+                                provider evidence.
+                              properties:
+                                openAPIV3Schema:
+                                  description: OpenAPIV3Schema is the schema for the
+                                    corresponding inline object.
+                                  type: object
+                                  x-kubernetes-preserve-unknown-fields: true
+                              type: object
+                          type: object
+                        supported:
+                          type: boolean
+                      required:
+                      - supported
+                      type: object
                     served:
                       description: Served controls whether new or updated specs may
                         reference this version.
@@ -326,6 +390,9 @@ spec:
                                 enum:
                                 - Accepted
                                 - Programmed
+                                - Withdrawn
+                                - Ready
+                                - OverrideAccepted
                                 type: string
                               description:
                                 description: Description explains when the provider-specific

app/operator/config/crd/bases/dns.appthrust.io_recordsets.yaml

@@ -223,11 +223,13 @@ spec:
                 properties:
                   name:
                     description: Name is the Zone name.
+                    maxLength: 253
                     minLength: 1
                     type: string
                   namespace:
                     description: Namespace defaults to the RecordSet namespace when
                       omitted.
+                    maxLength: 63
                     type: string
                 required:
                 - name