feat(dns): git SoR + drift-check for pihole/dhcpd; serial-restart rule [#469][#420]

AGENTS.md

@@ -288,6 +288,19 @@ Hard-won operational gotchas. One line each; keep them short and load-bearing.
 - **Supervisor add-on options via API:** docker cp a script into
   hassio_supervisor, read token from /data/cli.json `access_token`, POST
   /addons/<slug>/options (the /apps/ spelling 404s).
+- **NEVER restart/kill BOTH members of a redundant pair simultaneously**
+  (founder ruling 2026-09-01 after the DNS outage): restart/redeploy ONE
+  node, verify service health from an independent vantage, only then the
+  second. Blue/green with a health gate between hops — always serial.
+- **Pi-hole v6: `dnsmasq_lines` in pihole.toml are passed to FTL's embedded
+  dnsmasq, which rejects some valid-dnsmasq options (e.g. `no-negcache`)
+  with "bad option" and dnsmasq then never starts — the container looks
+  "Up" but serves nothing on :53. Use first-class toml settings instead;
+  never sed-edit pihole.toml without a single-node health-gated rollout.
+- **DNS outage recovery path:** workstation resolv.conf dies with the LAN
+  Pi-holes; use `tailscale status` peer IPs + the chokepoint env overrides
+  (NETINFRA01_HOST/NETINFRA02_HOST, VM_IP) to reach hosts by Tailscale
+  while names are unresolvable. Fix one node, verify, then the other.
 
 ## Questions (NON-NEGOTIABLE)