feat(dns): zone-snapshot tooling + sync rule; refresh stale snapshots [#630][#728]

Founder rule: every Technitium/DNS/DHCP change ends with a same-session
SoR sync — zone-snapshot.sh then drift-check green, then commit. Added
the tool (tar-pulls the DZ store from the primary via the chokepoint),
wrote the rule into AGENTS.md (DNS change discipline + Key Scripts rows),
refreshed 4 stale snapshots (knel.net, 1/3.168.192 reverse, 119.70.100
— incl. the deleted ultix-offstage PTR). drift-check: ALL IN SYNC.
Also: last tsrouter mentions retired (AGENTS.md, setup.sh header).

netinfra/dns/technitium/zone-snapshot.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/bash
+#
+# zone-snapshot.sh — refresh the git SoR snapshot of the Technitium zone
+# store [#630][#728]
+#
+# Pulls the binary DZ zone files from netinfra-01 (the replication primary)
+# into netinfra/dns/technitium/zones/ via the remote-dns.sh chokepoint, then
+# shows which snapshot files changed.
+#
+# RULE (founder, 2026-09-02): run this after EVERY Technitium record change
+# and commit the refreshed snapshots in the same session, so the git SoR
+# never goes stale. netinfra/dns/drift-check.sh verifies the result; the
+# pre-push rule audit fails on a stale questions file and drift-check is the
+# DNS counterpart: green before you push any DNS-adjacent change.
+#
+# Usage:
+#   zone-snapshot.sh            refresh snapshots from the primary
+#   zone-snapshot.sh --check    verify only (delegates to drift-check.sh)
+#
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"          # netinfra/dns/technitium
+REPO="$(cd "$HERE/../../.." && pwd)"
+REMOTE_DNS="$HERE/../../dns-cluster-setup/remote-dns.sh"
+ZONES_DIR="$HERE/zones"
+REMOTE_ZONE_DIR="/home/localuser/services/technitium/config/zones"
+
+if [ "${1:-}" = "--check" ]; then
+  exec bash "$HERE/../drift-check.sh"
+fi
+
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+
+echo "Fetching zone store from netinfra-01 (primary)..."
+bash "$REMOTE_DNS" netinfra01-root "cd '$REMOTE_ZONE_DIR' && tar cf - *.zone" > "$tmp/zones.tar"
+
+# Validate the archive before touching the tracked tree.
+tar -tf "$tmp/zones.tar" >/dev/null
+
+mkdir -p "$ZONES_DIR"
+find "$ZONES_DIR" -maxdepth 1 -name '*.zone' -delete
+tar -xf "$tmp/zones.tar" -C "$ZONES_DIR"
+
+count="$(find "$ZONES_DIR" -maxdepth 1 -name '*.zone' | wc -l)"
+echo "Snapshotted $count zone files into ${ZONES_DIR#"$REPO"/}"
+
+echo "Changed snapshot files (git):"
+changed="$(git -C "$REPO" status --porcelain -- "$ZONES_DIR")"
+if [ -n "$changed" ]; then
+  printf '%s\n' "$changed" | sed "s|^$REPO/||" | head -20
+  printf '%s\n' "$changed" | wc -l | xargs -I{} echo "{} files changed — commit these in the same session (DNS sync rule)"
+else
+  echo "  (none — snapshots were already current)"
+fi
+
+echo "Verify with: netinfra/dns/drift-check.sh"