feat(netinfra): NTP + Technitium zones into git SoR; drift-check full stack [#630]

ntp.conf captured (nodes byte-identical); 171 Technitium DZ zone files
captured from the primary; drift-check now covers dhcpd/pihole/ntp on
both nodes plus a zones md5-manifest check. Live run caught real drift:
node-02 dhcpd.conf was a stale primary copy missing the #614 minisplit
reservation — reconciled git->02 with dhcpd -t gate, serial restart,
failover "Both servers normal", all 7 checks in sync. Red-green unit
tests extended (gen_manifest, tracked-file invariants).

Results: https://projects.knownelement.com/issues/630#note-2

tests/unit/dns-drift-check.sh

@@ -60,6 +60,48 @@ test_redact_strips_secrets
 test_normalize_drops_timestamp
 test_normalize_implies_redaction
 
+test_ntp_conf_tracked() {
+    if [[ -n "${NTP_FILE:-}" && -f "$NTP_FILE" ]]; then
+        echo "✅ NTP_FILE points at tracked canonical config"
+    else
+        echo "❌ NTP_FILE missing or file absent: ${NTP_FILE:-unset}"
+        ((++failed))
+    fi
+}
+
+test_zones_dir_tracked() {
+    if [[ -n "${ZONES_DIR:-}" && -d "$ZONES_DIR" ]] && compgen -G "${ZONES_DIR}/*.zone" > /dev/null; then
+        echo "✅ ZONES_DIR present with zone files"
+    else
+        echo "❌ ZONES_DIR missing or empty: ${ZONES_DIR:-unset}"
+        ((++failed))
+    fi
+}
+
+test_gen_manifest_sorted_md5() {
+    local fxt out n
+    fxt="$(mktemp -d)"
+    printf 'A' > "$fxt/zz.zone"
+    printf 'B' > "$fxt/aa.zone"
+    printf 'S' > "$fxt/ignored.txt"
+    out="$(gen_manifest "$fxt")"
+    n="$(wc -l <<<"$out")"
+    if [[ "$n" -eq 2 ]] \
+        && grep -qE '^[0-9a-f]{32}  (aa|zz)\.zone$' <<<"$out" \
+        && [[ "$(head -1 <<<"$out")" == *"aa.zone" ]] \
+        && ! grep -q 'ignored' <<<"$out"; then
+        echo "✅ gen_manifest: md5 of *.zone only, name-sorted"
+    else
+        echo "❌ gen_manifest wrong output"
+        ((++failed))
+    fi
+    rm -rf "$fxt"
+}
+
+test_ntp_conf_tracked
+test_zones_dir_tracked
+test_gen_manifest_sorted_md5
+
 if ((failed > 0)); then
     echo "❌ $failed drift-check test(s) failed"
     exit 1