atenet/dns: actor zone returns SERVFAIL for non-A queries, breaking strict resolvers (e.g., Alpine/musl)

[Yuan Gao (ygao-g)]

Fixes: #888

Background & Problem
When modern operating systems resolve a hostname, they query for both IPv4 (A) and IPv6 (AAAA) records concurrently. Currently, the actor DNS zone only answers A queries and returns a SERVFAIL (rcode 2) for everything else. A SERVFAIL response is treated as a hard network error by strict resolvers (rather than a successful empty answer).

Changes in this PR
This PR ensures the zone returns a correct response code for what it does not answer, rather than crashing out with SERVFAIL. Specifically, it introduces:

• A correct NODATA response: For valid actor names queried with non-A types (e.g., AAAA, HTTPS, SRV), we now use a regex-scoped NODATA template that returns rcode NOERROR alongside an SOA record in the authority section.
• A correct NXDOMAIN response: A terminal NXDOMAIN catch-all is added for names in the zone that do not exist.

(Note: This PR does not publish an AAAA record; it only fixes the zone's error handling to unblock IPv4 clients. Publishing the AAAA record is handled separately in #938.)

[Yuan Gao (ygao-g)]

Bowei Du (@bowei) Julian Gutierrez Oschmann (@juli4n) mind taking a look?

This is the SERVFAIL half of #246, step one of your three: the actor zone can't
answer AAAA (or any non-A qtype) at all today, which breaks musl clients on
IPv4-only clusters before dual-stack enters the picture. It makes AAAA a correct
empty answer and deliberately stops short of publishing one — the Scope
paragraph spells out why that has to wait for the router's v6 listener, and
Bowei Du (@bowei), that's the sequencing claim I'd most like checked.

Julian Gutierrez Oschmann (@juli4n), the substance is three template blocks in corefile.go and the order
between them. The fallthrough on each block carrying a match is load-bearing
in a way the plugin docs don't make obvious, so TestMakeCoreFile pins the whole
rendered zone as a golden rather than asserting substrings.

Verified against coredns/coredns:1.11.1, the pinned image, not just the
rendered file — details in the Testing section. One known gap filed as #922: the
catch-all NXDOMAINs empty non-terminals, which is latent today but wrong.

[Bowei Du (bowei)]

Yuan -- it would be good to be very specific on what we are doing in this PR. From what I can tell:

• Add support for IPv6 AAAA for Substrate names.
• Fix any associated things needed to get this working.

Is this what you are trying to do?

[Yuan Gao (ygao-g)]

Close, but that's two PRs and this is the smaller one.

This PR doesn't publish an AAAA. It makes the zone return a correct rcode for what it doesn't answer — NODATA for a real actor name on a non-A qtype, NXDOMAIN for a name in the zone that doesn't exist. Both SERVFAIL today, on IPv4-only clusters too, which is why musl-based actors can't resolve each other at all: #888.

Publishing AAAA is #938. The three together:

#874 (this)	the zone can answer a non-A qtype at all
#911	the router Service has a v6 ClusterIP and Envoy is bound on ::
#938	the zone publishes an address record per family the router has a ClusterIP in

Every actor name resolves to the same address — the router ClusterIP, with per-actor demux at Envoy on the Host header — so an AAAA for a Substrate name is those three things, and no one of them is useful alone. End state on dual-stack: an actor name resolves in both families and Envoy answers on either. Each PR carries its own verification; the real gap is that dual-stack isn't testable until #877 lands, so #911's dual-stack behaviour is argued rather than run.

On "fix any associated things" — past DNS, three more sit between a published AAAA and a usable IPv6 path, now filed as step-3 sub-tasks: #943, #944, #945.