cc-ci host: one resolver set (no Hetzner caches), pin the host's own names

During the DNS cutover the Hetzner resolvers nixos-infect had left in
networking.nix still served the old address (3h TTL) while 1.1.1.1/8.8.8.8
had the new one, so every other lookup of drone.ci.commoninternet.net from
the box itself went to the old server: runner "cannot request stage 404",
bridge "drone trigger failed 404", traefik probes alternating 200/404.
Drop those resolvers; pin ci/drone/report/traefik/warm-keycloak/oc names to
this host in networking.hosts. README §7 records it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

README.md

@@ -301,7 +301,11 @@ stopped on the new host while its directory is copied:
 
 1. **DNS** (operator, Gandi zone `commoninternet.net`): A records `ci`, `*.ci` and `ns-acme` →
    the new IPv4. `acme NS ns-acme` and `_acme-challenge.ci CNAME <account>.acme…` stay as they
-   are. Wait for propagation (`dig +short ci.commoninternet.net`).
+   are. Wait for propagation (`dig +short ci.commoninternet.net`) — the records carry a 3 h TTL,
+   and resolvers that cached the old answer (the Hetzner ones in particular) keep serving it that
+   long. The new host must not list such a resolver: with a mixed set, every other lookup of its
+   own names went to the old server on 2026-09-07 (runner/bridge 404s). `networking.nix` drops
+   the Hetzner resolvers and `configuration.nix` pins the host's own names.
 2. Check the new host answers on the new IP before DNS moves: `dig @<new-ip> ns-acme.commoninternet.net`
    (acme-dns), `curl --resolve ci.commoninternet.net:443:<new-ip> https://ci.commoninternet.net/`
    (dashboard, valid cert), same for `report.ci` and `drone.ci`.