fix(audit): scope refinements + authoritative DNS checks [#446]

Exclude the Reston prod VPS (tsys-cloudron-new) from all future audits,
mark Home Assistant and Umbrel as by-design no-SSH appliances, and query
Technitium directly (dig @netinfra-01) instead of getent so local
/etc/hosts entries cannot produce false mismatches. Drops aliases made
obsolete by the sectestbed-hfnoc-uisp rename.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

scripts/audit-fleet.sh

@@ -11,6 +11,8 @@
 #
 # Emits pipe-delimited results on stdout (one line per host), progress on
 # stderr, per-host SSH stderr into $1 (default /tmp/fleet-audit-errors.log).
+# Scope: tsys-cloudron-new (Reston prod VPS) is excluded entirely;
+# homeassistant/umbrel get DNS/name checks but no SSH probe (appliance OSes).
 # Example: bash scripts/audit-fleet.sh > /tmp/fleet-audit.tsv
 #
 set -uo pipefail
@@ -19,6 +21,7 @@ REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 REMOTE="$REPO_ROOT/tests/remote.sh"
 REMOTE_DNS="$REPO_ROOT/netinfra/dns-cluster-setup/remote-dns.sh"
 DNS_SUFFIX="knel.net"
+DNS_SERVER="pfv-netinfra-01.knel.net"
 PROX_NODES=(pfv-tsys1 pfv-tsys3 pfv-tsys4 pfv-tsys5 pfv-tsys6 pfv-tsys7 pfv-tsys9)
 PROBE='id -un; hostname; sudo -n id -un 2>/dev/null || echo SUDO_FAIL'
 
@@ -29,8 +32,6 @@ knel_alias() {
         homeassistant)     printf '%s' "pfv-bms" ;;
         umbrel)            printf '%s' "tsys-umbrel" ;;
         ultixfield)        printf '%s' "ultix-field" ;;
-        sectestbed-hfnoc)  printf '%s' "sectestbed-hfnoc-uisp" ;;
-        tsys-cloudron-new) printf '%s' "tsys-cloudron" ;;
         *)                 printf '%s' "$1" ;;
     esac
 }
@@ -54,7 +55,7 @@ classify() {
 
 dns_lookup() {
     local fqdn="$1" want="$2" got
-    got="$(getent ahostsv4 "$fqdn" 2>/dev/null | awk 'NR==1 {print $1}')"
+    got="$(dig +short "@$DNS_SERVER" "$fqdn" A 2>/dev/null | tail -n 1)"
     if [ -z "$got" ]; then
         printf '%s' "NXDOMAIN"
     elif [ "$got" = "$want" ]; then
@@ -104,12 +105,23 @@ while IFS=$'\t' read -r host ts_ip online; do
         vm_name="PHYSICAL_OR_MISSING"
     fi
 
+    case "$host" in
+        tsys-cloudron-new) continue ;;  # Reston prod VPS — out of audit scope
+    esac
+
     if [ "$online" != "true" ]; then
         printf '%s|%s|%s|%s|%s|%s|%s|%s|%s|%s\n' \
             "$host" "$ts_ip" "$online" "$fqdn" "$dns_result" "$vm_name" "-" "OFFLINE" "-" "-"
         continue
     fi
 
+    case "$host" in
+        homeassistant|umbrel)
+            printf '%s|%s|%s|%s|%s|%s|%s|%s|%s|%s\n' \
+                "$host" "$ts_ip" "$online" "$fqdn" "$dns_result" "$vm_name" "-" "BY_DESIGN_NO_SSH" "-" "-"
+            continue ;;
+    esac
+
     read -r user mode <<< "$(classify "$host")"
 
     case "$mode" in