domain cutover: front doors + drone + per-run naming to ci.autonomic.zone

- acme-dns.nix: ONE dual-zone SAN cert (ci+*.ci.autonomic.zone AND ci+*.ci.commoninternet.net)
  via the same acmedns account — storage re-keyed by cc-ci-acme-storage-seed.service; handoff
  reads the new cert dir. Single secret pair => zero changes to the traefik reconciler.
- dashboard/bridge/reports: dual Host rules during the bake window (bridge gets explicit
  parentheses so && does not shadow the dashboard on the new host).
- drone abra app renamed to drone.ci.autonomic.zone (fresh DB supported: DRONE_USER_CREATE
  re-injects the sops bridge token); runner RPC + bootstrap-drone-oauth.sh follow.
- harness: app_domain() issues *.ci.autonomic.zone run domains; RUN_APP_RE / stack-name
  regexes / docker-prune accept BOTH zones during the bake. Warm stacks deliberately stay
  on the legacy zone (data-warm volumes; post-bake migration).
- URLs in bridge/dashboard defaults + recipe-report.py follow the new names.

nix/modules/acme-dns.nix

@@ -1,8 +1,13 @@
-# Restricted DNS-01 certificate issuance for ci.commoninternet.net.
+# Restricted DNS-01 certificate issuance for ci.autonomic.zone (+ legacy ci.commoninternet.net).
 #
 # This host is authoritative only for acme.commoninternet.net. Gandi continues
-# to own commoninternet.net; it delegates this narrow zone and one permanent
-# _acme-challenge CNAME manually. No Gandi credential is present here.
+# to own commoninternet.net AND autonomic.zone; both zones delegate their narrow
+# _acme-challenge CNAME to the same acme-dns account. No Gandi credential is present here.
+#
+# Domain cutover 2026-09: ONE cert now covers BOTH zones (SANs: ci/*.ci.autonomic.zone +
+# ci/*.ci.commoninternet.net) — a single secret pair flows through the unchanged
+# warm_reconcile._traefik_setup ssl_cert/ssl_key flow, avoiding dual-cert SNI entirely.
+# The legacy commoninternet.net SANs are dropped in Phase 4 (post-bake reissue).
 { config, pkgs, ... }:
 let
   publicIPv4 = config.cc-ci.publicIPv4;
@@ -42,11 +47,40 @@ let
 
   # These are wiring values only. The acme-dns account JSON is generated by
   # Lego below /var/lib/acme and never enters Nix, git, or /etc.
+  # Storage path points at the NEW cert's dir; cc-ci-acme-storage-seed.service
+  # (below) clones the legacy account entry into it under the new zone key so
+  # Lego can write the new zone's TXT via the same (registration-disabled)
+  # acme-dns account — the CNAME for _acme-challenge.ci.autonomic.zone already
+  # delegates to that account's subdomain.
   legoEnvironment = pkgs.writeText "cc-ci-acme-dns-lego.env" ''
     ACME_DNS_API_BASE=http://127.0.0.1:8080
-    ACME_DNS_STORAGE_PATH=/var/lib/acme/ci.commoninternet.net/acme-dns-accounts.json
+    ACME_DNS_STORAGE_PATH=/var/lib/acme/ci.autonomic.zone/acme-dns-accounts.json
     ACME_DNS_ALLOWLIST=127.0.0.1/32
   '';
+
+  # Seed the new cert's acmedns storage from the legacy one: same acme-dns
+  # account (same subdomain/credentials — the only thing the DNS CNAME points
+  # at), re-keyed for the new zone. Idempotent; runs before the ACME unit.
+  acmeStorageSeed = pkgs.writeShellApplication {
+    name = "cc-ci-acme-storage-seed";
+    runtimeInputs = with pkgs; [ jq coreutils ];
+    text = ''
+      src=/var/lib/acme/ci.commoninternet.net/acme-dns-accounts.json
+      dst=/var/lib/acme/ci.autonomic.zone/acme-dns-accounts.json
+      install -d -m 0700 /var/lib/acme/ci.autonomic.zone
+      if [ ! -s "$src" ]; then
+        echo "storage seed: no legacy accounts.json — skipping (fresh host?)"
+        exit 0
+      fi
+      jq 'if has("ci.autonomic.zone") then .
+          elif has("ci.commoninternet.net") then
+            . + { "ci.autonomic.zone": .["ci.commoninternet.net"] }
+          else . end' "$src" > "$dst.tmp"
+      mv "$dst.tmp" "$dst"
+      chmod 0600 "$dst"
+      echo "storage seed: ok"
+    '';
+  };
 in
 {
   imports = [ ./options.nix ];
@@ -103,6 +137,20 @@ in
       };
     };
 
+    # Seed the new cert's acmedns storage before the ACME unit first runs (see
+    # acmeStorageSeed above). Ordering via the generated acme unit name.
+    systemd.services.cc-ci-acme-storage-seed = {
+      description = "Seed ci.autonomic.zone acme-dns storage from the legacy account";
+      after = [ "acme-dns.service" ];
+      wantedBy = [ "acme-ci.autonomic.zone.service" ];
+      before = [ "acme-ci.autonomic.zone.service" ];
+      serviceConfig = {
+        Type = "oneshot";
+        UMask = "0077";
+      };
+      script = "${acmeStorageSeed}/bin/cc-ci-acme-storage-seed";
+    };
+
     # Traefik consumes its wildcard as immutable Swarm secrets, so a renewed
     # host certificate must be copied and reconciled rather than merely reloaded.
     # This service is started only by the production-mode ACME postRun hook.
@@ -116,7 +164,7 @@ in
         UMask = "0077";
       };
       script = ''
-        src=/var/lib/acme/ci.commoninternet.net
+        src=/var/lib/acme/ci.autonomic.zone
         dst=/var/lib/ci-certs/live
         test -s "$src/fullchain.pem"
         test -s "$src/key.pem"
@@ -144,11 +192,18 @@ in
 
   security.acme = {
     acceptTerms = true;
-    certs."ci.commoninternet.net" = {
-      domain = "ci.commoninternet.net";
-      extraDomainNames = [ "*.ci.commoninternet.net" ];
-      # Staging issuance succeeded using the permanent, narrowly delegated
-      # CNAME. Production uses the same restricted acme-dns account.
+    certs."ci.autonomic.zone" = {
+      domain = "ci.autonomic.zone";
+      # Dual-zone SANs: the new zone + the legacy one. One cert = one ssl_cert/ssl_key
+      # secret pair = zero traefik reconciler changes. Phase 4 drops the legacy SANs.
+      extraDomainNames = [
+        "*.ci.autonomic.zone"
+        "ci.commoninternet.net"
+        "*.ci.commoninternet.net"
+      ];
+      # Staging issuance proved the permanent, narrowly delegated CNAME and the
+      # restricted acme-dns account. Production uses the same account (re-keyed
+      # for the new zone by cc-ci-acme-storage-seed.service).
       dnsProvider = "acmedns";
       environmentFile = "/etc/acme-dns/lego.env";
       dnsResolver = "1.1.1.1:53";