feat(dns): zone-snapshot tooling + sync rule; refresh stale snapshots [#630][#728]

Founder rule: every Technitium/DNS/DHCP change ends with a same-session
SoR sync — zone-snapshot.sh then drift-check green, then commit. Added
the tool (tar-pulls the DZ store from the primary via the chokepoint),
wrote the rule into AGENTS.md (DNS change discipline + Key Scripts rows),
refreshed 4 stale snapshots (knel.net, 1/3.168.192 reverse, 119.70.100
— incl. the deleted ultix-offstage PTR). drift-check: ALL IN SYNC.
Also: last tsrouter mentions retired (AGENTS.md, setup.sh header).

netinfra/dns-cluster-setup/setup.sh

@@ -116,7 +116,8 @@ api_call() {
 }
 
 # -----------------------------------------------------------------------------
-# Step 1: Export production config (READ-ONLY on tailscale-router)
+# Step 1: Export production config (READ-ONLY on the primary; historically
+# the retired tailscale-router)
 # -----------------------------------------------------------------------------
 do_export() {
   log "=== STEP 1: Exporting production config from $PROD (READ-ONLY) ==="