feat: netinfra test set — Pi-hole + Technitium compose for VM 5109 [#769]

Deployed live on sectestbed-netinfra; both resolvers verified.
preprod counterpart VM 53109 cloned+running on tsys5. Upstreams
1.1.1.1 (tsys5 VM subnets cannot reach LAN gw 192.168.3.1).

https://projects.knownelement.com/issues/769#note-4152

testset/README.md

@@ -0,0 +1,8 @@
+# netinfra test set
+
+> **Docs live on Discourse — this repo is the executable source of truth.**
+> **Topic:** https://community.turnsys.com/t/306 · **Env map:** https://community.turnsys.com/t/331
+
+Sectestbed netinfra set (VM 5109 `sectestbed-netinfra`, pfv-tsys5): Pi-hole 2026.07.2 + Technitium 15.4.0 for version testing ahead of prod (netinfra-01/02). Preprod counterpart: VM 53109 `preprod-netinfra` (same host; app provisioning pending — template lacks qemu-guest-agent).
+
+Deploy: `VM_IP=sectestbed-netinfra VM_USER=root bash tests/remote.sh vm-copy` from PFVCluster, then `cd /opt/netinfra-test && docker compose up -d`.

testset/compose.yaml

@@ -0,0 +1,38 @@
+# netinfra test set — deployed on sectestbed-netinfra (VM 5109, tsys5) [#769]
+# Pi-hole = the DNS test target (VM LAN :53); Technitium = admin/version test
+# (loopback :5380, DNS on loopback :5353 to avoid the :53 conflict).
+# NOTE: upstreams point at 1.1.1.1 — tsys5 VM subnets cannot reach the
+# 192.168.3.x LAN gateway.
+services:
+  pihole:
+    image: pihole/pihole:2026.07.2
+    container_name: ukrrs-pfv-pihole-test
+    ports:
+      - "53:53/tcp"
+      - "53:53/udp"
+      - "80:80/tcp"
+    environment:
+      TZ: America/Chicago
+      FTLCONF_webserver_api_password: "sectestbed-only"
+      FTLCONF_dns_upstreams: "1.1.1.1"
+    volumes:
+      - pihole-etc:/etc/pihole
+    restart: unless-stopped
+
+  technitium:
+    image: technitium/dns-server:15.4.0
+    container_name: ukrrs-pfv-technitium-test
+    ports:
+      - "127.0.0.1:5380:5380/tcp"
+      - "127.0.0.1:5353:53/udp"
+      - "127.0.0.1:5353:53/tcp"
+    environment:
+      DNS_SERVER_DOMAIN: sectestbed-netinfra.knel.net
+      DNS_SERVER_ADMIN_PASSWORD: "sectestbed-only"
+    volumes:
+      - technitium-config:/etc/dns
+    restart: unless-stopped
+
+volumes:
+  pihole-etc:
+  technitium-config: