Facts carry the format as a template, so the control plane holds none (ADR 0120)

A roster fact used to be a name from a closed list, each formatted in Go
here — node-names as a hosts file, node-zones as a resolver's zones. Every
new consumer (ssh's known_hosts, an authorized_keys) meant another formatter
in the control plane, in the consumer's own configuration language.

Now a fact is a path and a Go template over the roster view (this node, the
suffix, and every served name vs the machines). The mesh owns the data; the
module owns the format. /etc/hosts is a template on the network module;
dnsmasq's zones move to dnsmasq. The controller renders and reads neither.

WireGuard stays a computed generator: the overlay is the substrate delivery
rides on, and its config is topology, not a roster projection.

Output is byte-for-byte unchanged, pinned by the hosts golden tests and the
resolver tests that compose the real dnsmasq manifest.

internal/catalogue/resolver_manifests_test.go

@@ -50,7 +50,7 @@ func TestTheResolverForwardsToFixedUpstreamsAndNeverReadsResolvConf(t *testing.T
 		"\nno-resolv\n", "\nserver=1.1.1.1\n", "\nserver=8.8.8.8\n",
 		"\nlisten-address=127.0.0.1\n", "\ninterface=mesh0\n", "\nbind-dynamic\n",
 		"\ndomain-needed\n", "\nbogus-priv\n",
-		"\nconf-file=" + m.Facts[FactNodeZones] + "\n",
+		"\nconf-file=" + m.Facts["node-zones"].Path + "\n",
 	} {
 		if !strings.Contains(config, want) {
 			t.Errorf("the resolver's configuration lacks %q:\n%s", strings.TrimSpace(want), config)