domain cutover: front doors + drone + per-run naming to ci.autonomic.zone

- acme-dns.nix: ONE dual-zone SAN cert (ci+*.ci.autonomic.zone AND ci+*.ci.commoninternet.net)
  via the same acmedns account — storage re-keyed by cc-ci-acme-storage-seed.service; handoff
  reads the new cert dir. Single secret pair => zero changes to the traefik reconciler.
- dashboard/bridge/reports: dual Host rules during the bake window (bridge gets explicit
  parentheses so && does not shadow the dashboard on the new host).
- drone abra app renamed to drone.ci.autonomic.zone (fresh DB supported: DRONE_USER_CREATE
  re-injects the sops bridge token); runner RPC + bootstrap-drone-oauth.sh follow.
- harness: app_domain() issues *.ci.autonomic.zone run domains; RUN_APP_RE / stack-name
  regexes / docker-prune accept BOTH zones during the bake. Warm stacks deliberately stay
  on the legacy zone (data-warm volumes; post-bake migration).
- URLs in bridge/dashboard defaults + recipe-report.py follow the new names.

nix/modules/dashboard.nix

@@ -1,4 +1,4 @@
-# Results dashboard (§4.5, D7): the YunoHost-CI-like overview at ci.commoninternet.net. Reads the
+# Results dashboard (§4.5, D7): the YunoHost-CI-like overview at ci.autonomic.zone. Reads the
 # Drone API (read-only) and renders latest-run-per-recipe + SVG badges. Packaged as a Nix-built OCI
 # image and run as a swarm service on `proxy`, routed by traefik at Host(ci.commoninternet.net) — the
 # comment-bridge's Host && PathPrefix(`/hook`) rule is longer, so /hook still wins (priority by rule
@@ -33,7 +33,7 @@ let
       app:
         image: cc-ci-dashboard:${imageTag}
         environment:
-          - DRONE_URL=https://drone.ci.commoninternet.net
+          - DRONE_URL=https://drone.ci.autonomic.zone
           - CI_REPO=recipe-maintainers/cc-ci
           - DASH_LISTEN=0.0.0.0:8080
           - DRONE_TOKEN_FILE=/run/secrets/drone_token
@@ -57,7 +57,7 @@ let
           labels:
             - "traefik.enable=true"
             - "traefik.http.services.ccci-dashboard.loadbalancer.server.port=8080"
-            - "traefik.http.routers.ccci-dashboard.rule=Host(`ci.commoninternet.net`)"
+            - "traefik.http.routers.ccci-dashboard.rule=Host(`ci.autonomic.zone`) || Host(`ci.commoninternet.net`)"
             - "traefik.http.routers.ccci-dashboard.entrypoints=web-secure"
             - "traefik.http.routers.ccci-dashboard.tls=true"
     networks: