domain cutover: front doors + drone + per-run naming to ci.autonomic.zone

- acme-dns.nix: ONE dual-zone SAN cert (ci+*.ci.autonomic.zone AND ci+*.ci.commoninternet.net)
  via the same acmedns account — storage re-keyed by cc-ci-acme-storage-seed.service; handoff
  reads the new cert dir. Single secret pair => zero changes to the traefik reconciler.
- dashboard/bridge/reports: dual Host rules during the bake window (bridge gets explicit
  parentheses so && does not shadow the dashboard on the new host).
- drone abra app renamed to drone.ci.autonomic.zone (fresh DB supported: DRONE_USER_CREATE
  re-injects the sops bridge token); runner RPC + bootstrap-drone-oauth.sh follow.
- harness: app_domain() issues *.ci.autonomic.zone run domains; RUN_APP_RE / stack-name
  regexes / docker-prune accept BOTH zones during the bake. Warm stacks deliberately stay
  on the legacy zone (data-warm volumes; post-bake migration).
- URLs in bridge/dashboard defaults + recipe-report.py follow the new names.

runner/harness/lifecycle.py

@@ -25,7 +25,7 @@ from . import meta as meta_mod
 GATEWAY_IP = "143.244.213.108"  # *.ci.commoninternet.net -> gateway (TLS passthrough to cc-ci)
 # A run app domain is "<recipe[:4]>-<6hex>.ci.commoninternet.net" (see DECISIONS.md). Used by the
 # janitor to recognise orphaned run apps (infra apps like traefik/drone/backups don't match).
-RUN_APP_RE = re.compile(r"^[a-z0-9]{1,4}-[0-9a-f]{6}\.ci\.commoninternet\.net$")
+RUN_APP_RE = re.compile(r"^[a-z0-9]{1,4}-[0-9a-f]{6}\.ci\.(?:autonomic\.zone|commoninternet\.net)$")
 
 
 class TeardownError(RuntimeError):
@@ -1190,7 +1190,7 @@ def janitor() -> None:
     # also catch stacks whose .env was already deleted (abra ls won't list them)
     for svc in _docker_names("service", ""):
         # svc like cust-c95a69_ci_commoninternet_net_app -> reconstruct domain
-        m = re.match(r"^([a-z0-9]{1,4}-[0-9a-f]{6})_ci_commoninternet_net_", svc)
+        m = re.match(r"^([a-z0-9]{1,4}-[0-9a-f]{6})_ci_(?:autonomic_zone|commoninternet_net)_", svc)
         if m:
             seen.add(f"{m.group(1)}.ci.commoninternet.net")