fix(dns): retire tailscale-router references; netinfra pair is prod [#728]

Founder ruling 2026-09-02: tailscale-router retired, subnet routing now
pfv-netinfra-01/02 (both advertise 192.168.0.0/22 + exit routes, verified).
Drop dead tsrouter alias from the chokepoint script; setup/verify now use
the primary as production source; refresh verify record list (tsys-nsm is
also a dead name; add tsys-wazuh CNAME + tsys-siem).

archive/KNELServerBuild copies left as read-only history by design.

netinfra/dns-cluster-setup/verify.sh

@@ -13,7 +13,9 @@ REMOTE="$HERE/remote-dns.sh"
 
 PRIMARY="netinfra01"
 SECONDARY="netinfra02"
-PROD="tsrouter"
+# The retired tailscale-router was the old PROD comparison target; the
+# primary itself is production since 2026-09-02.
+PROD="$PRIMARY"
 
 PRIMARY_IP="${PRIMARY_IP:-192.168.3.252}"
 SECONDARY_IP="${SECONDARY_IP:-192.168.3.253}"
@@ -89,7 +91,7 @@ fi
 section "4. knel.net zone resolves identically on primary and secondary"
 
 # Query a known record on both servers directly via Technitium's port
-for name in pfv-netinfra-01 pfv-netinfra-02 tailscale-router tsys-cloudron tsys-nsm; do
+for name in pfv-netinfra-01 pfv-netinfra-02 tsys-cloudron tsys-siem tsys-wazuh; do
   fqdn="${name}.knel.net"
   # Query via dig against each Technitium instance (through Pi-hole on :53)
   pri_ans=$(run "$PRIMARY" "dig +short +time=3 +tries=1 @127.0.0.1 -p 53 $fqdn A 2>/dev/null | head -1" 2>/dev/null || true)