domain cutover: front doors + drone + per-run naming to ci.autonomic.zone

- acme-dns.nix: ONE dual-zone SAN cert (ci+*.ci.autonomic.zone AND ci+*.ci.commoninternet.net)
  via the same acmedns account — storage re-keyed by cc-ci-acme-storage-seed.service; handoff
  reads the new cert dir. Single secret pair => zero changes to the traefik reconciler.
- dashboard/bridge/reports: dual Host rules during the bake window (bridge gets explicit
  parentheses so && does not shadow the dashboard on the new host).
- drone abra app renamed to drone.ci.autonomic.zone (fresh DB supported: DRONE_USER_CREATE
  re-injects the sops bridge token); runner RPC + bootstrap-drone-oauth.sh follow.
- harness: app_domain() issues *.ci.autonomic.zone run domains; RUN_APP_RE / stack-name
  regexes / docker-prune accept BOTH zones during the bake. Warm stacks deliberately stay
  on the legacy zone (data-warm volumes; post-bake migration).
- URLs in bridge/dashboard defaults + recipe-report.py follow the new names.

nix/modules/reports.nix

@@ -73,7 +73,7 @@ let
           labels:
             - "traefik.enable=true"
             - "traefik.http.services.ccci-reports.loadbalancer.server.port=80"
-            - "traefik.http.routers.ccci-reports.rule=Host(`report.ci.commoninternet.net`)"
+            - "traefik.http.routers.ccci-reports.rule=Host(`report.ci.autonomic.zone`) || Host(`report.ci.commoninternet.net`)"
             - "traefik.http.routers.ccci-reports.entrypoints=web-secure"
             - "traefik.http.routers.ccci-reports.tls=true"
     networks: