The mesh's one resolver: its seat, a provider's address, zones, and a node's hosts file (hq ADR 0194, 0196, 0199)

- mesh-dns-resolver: a mesh seat delivering wildcard-resolution, so every node's resolver
  configuration resolves to its one holder; node-dns-resolver kept until nothing claims it.
- ${bound:<provision>:address}: the providing machine's private address, for the one consumer
  that cannot use a name — a machine's resolver configuration.
- zone: a module declares the zone it answers and the listen that answers it; the controller
  settles it per node, refuses duplicates and shadowing, and hands the resolver .Zones to forward.
- node-hosts-file: a node seat whose holder owns /etc/hosts, with entries/add/remove.
The resolver tests follow the catalogue: no runtime dns (containers copy the machine's resolvers),
live-restore held by resolv-conf, resolv.conf naming the resolver by address then a public one.

internal/catalogue/seats_test.go

@@ -46,13 +46,14 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 			delivered[s.Delivers] = s.Name
 		}
 	}
-	// Thirty-four with node-hotkeys (novox/hq ADR 0212); thirty-three with node-power (ADR 0211); thirty-two since the graphical session's
-	// eleven (ADR 0208); twenty-one with
-	// node-package-manager and node-container-runtime (ADR 0207); nineteen with node-environment and
-	// node-login-shell (ADR 0203, ADR 0204); seventeen with node-build-agent (ADR 0190). One fewer
-	// once the retired mesh-build-machine row goes, when no registered manifest claims it any more.
-	if len(Seats()) != 34 {
-		t.Errorf("the mesh defines %d seats rather than 34; the set is closed, so a change here is "+
+	// Thirty-six with mesh-dns-resolver (novox/hq ADR 0194) and node-hosts-file (ADR 0199); thirty-four
+	// with node-hotkeys (ADR 0212); thirty-three with node-power (ADR 0211); thirty-two since the
+	// graphical session's eleven (ADR 0208); twenty-one with node-package-manager and
+	// node-container-runtime (ADR 0207); nineteen with node-environment and node-login-shell (ADR 0203,
+	// ADR 0204); seventeen with node-build-agent (ADR 0190). Two fewer once the retired
+	// mesh-build-machine and node-dns-resolver rows go, when no registered manifest claims either.
+	if len(Seats()) != 36 {
+		t.Errorf("the mesh defines %d seats rather than 36; the set is closed, so a change here is "+
 			"a decision (novox/hq ADR 0110): %s", len(Seats()), seatNames())
 	}
 }