cc-ci host: one resolver set (no Hetzner caches), pin the host's own names

During the DNS cutover the Hetzner resolvers nixos-infect had left in
networking.nix still served the old address (3h TTL) while 1.1.1.1/8.8.8.8
had the new one, so every other lookup of drone.ci.commoninternet.net from
the box itself went to the old server: runner "cannot request stage 404",
bridge "drone trigger failed 404", traefik probes alternating 200/404.
Drop those resolvers; pin ci/drone/report/traefik/warm-keycloak/oc names to
this host in networking.hosts. README §7 records it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

nix/hosts/cc-ci/configuration.nix

@@ -79,6 +79,17 @@
   };
 
   networking.nameservers = [ "1.1.1.1" "8.8.8.8" ];
+  # This host's own public names resolve to itself regardless of external DNS state (host
+  # processes: the drone runner, the harness, the orchestrator; containers use the resolvers
+  # above). Per-run recipe domains are random and cannot be pinned — those follow public DNS.
+  networking.hosts."195.201.88.249" = [
+    "ci.commoninternet.net"
+    "drone.ci.commoninternet.net"
+    "report.ci.commoninternet.net"
+    "traefik.ci.commoninternet.net"
+    "warm-keycloak.ci.commoninternet.net"
+    "oc.ci.commoninternet.net"
+  ];
 
   # ---- memory: 8 GB RAM shared by the swarm (recipe deploys) and 3–6 agent sessions ---------
   swapDevices = [ { device = "/swapfile"; size = 8192; } ];