atenet/dns: answer non-A actor queries instead of SERVFAIL

[Yuan Gao (ygao-g)]

Fixes #888
Part of #246

The generated Corefile's template IN A block is the last directive in the server block, so any
query it doesn't match reaches plugin.NextOrFailure with a nil Next and comes back SERVFAIL —
AAAA for a valid actor, and any non-actor name in the zone.

This reproduces on an IPv4-only cluster and doesn't block on the dual-stack work in #246. musl
libc maps rcode 2 to EAI_AGAIN and abandons getaddrinfo without reading the paired A answer, so
an Alpine-based actor can't resolve another actor at all. Go's pure-Go resolver tolerates SERVFAIL
and uses the A answer anyway, which is why this went unnoticed: every DNS client in this repo is Go,
while actor images often aren't — demos/sandbox is Alpine (.ko.yaml). SERVFAIL also can't be
negatively cached, so every retry pays the full resolver timeout again.

Scope: this makes AAAA a correct empty answer; it does not publish one. An actor name still
has no IPv6 address after this change. Emitting AAAA is a later change in #246 and has to land after
the router's ingress listener accepts v6, or Happy Eyeballs will prefer a v6 address nothing is
listening on.

The fix appends two templates after the existing one:

• NODATA (NOERROR + SOA) for a real actor name queried on a non-A qtype. NXDOMAIN here would
  break musl too, which reads rcode 3 on either half of its parallel A/AAAA pair as "no addresses at
  all".
• An NXDOMAIN catch-all for names in the zone that genuinely don't exist.

Both carry an SOA authority record, which is what makes the negative answers cacheable.

Two mechanics of the CoreDNS template plugin drive the shape, and both are easy to get wrong:

• On a regex miss the plugin consults fall.Through() and returns SERVFAIL on the spot without
  evaluating any later template. So every block carrying a match needs fallthrough, or the
  blocks after it are unreachable. (A class or qtype mismatch behaves differently — it moves on by
  itself.)
• Templates are evaluated in Corefile order, so the IN A block must stay first and the
  regex-matched NODATA block must precede the catch-all. The catch-all must not declare
  fallthrough — it's the block that terminates the chain.

Testing

TestMakeCoreFileNegativeAnswers pins the ordering and shape the reasoning above depends on:
template order via strings.Index, exactly two actor match directives and two fallthroughs, two
SOA authority records, and that the catch-all carries no match of its own. TestMakeCoreFile's
golden directive list is extended to cover the new blocks.

These assert the rendered Corefile, not CoreDNS's behaviour on the wire — nothing here resolves a
name. The control-flow claims above come from reading the template plugin's ServeDNS loop; an e2e
that queries the live zone and asserts the rcode is a separate change.

Locally on the branch: go test -race ./... passes, and hack/verify-all.sh passes except
python-licenses.sh, which can't reach PyPI from my machine and is unrelated to this change (no
Python here).

• Tests pass
• Appropriate changes to documentation are included in the PR

🤖 Generated with Claude Code

[Yuan Gao (ygao-g)]

Is this change really needed? Seems like a cleanup to me. If so, consider removing it to Reduce diff size