domain cutover: front doors + drone + per-run naming to ci.autonomic.zone

- acme-dns.nix: ONE dual-zone SAN cert (ci+*.ci.autonomic.zone AND ci+*.ci.commoninternet.net)
  via the same acmedns account — storage re-keyed by cc-ci-acme-storage-seed.service; handoff
  reads the new cert dir. Single secret pair => zero changes to the traefik reconciler.
- dashboard/bridge/reports: dual Host rules during the bake window (bridge gets explicit
  parentheses so && does not shadow the dashboard on the new host).
- drone abra app renamed to drone.ci.autonomic.zone (fresh DB supported: DRONE_USER_CREATE
  re-injects the sops bridge token); runner RPC + bootstrap-drone-oauth.sh follow.
- harness: app_domain() issues *.ci.autonomic.zone run domains; RUN_APP_RE / stack-name
  regexes / docker-prune accept BOTH zones during the bake. Warm stacks deliberately stay
  on the legacy zone (data-warm volumes; post-bake migration).
- URLs in bridge/dashboard defaults + recipe-report.py follow the new names.

scripts/bootstrap-drone-oauth.sh

@@ -13,10 +13,10 @@ set -euo pipefail
 : "${GITEA_USERNAME:?set GITEA_USERNAME}"
 : "${GITEA_PASSWORD:?set GITEA_PASSWORD}"
 GITEA="${GITEA:-https://git.autonomic.zone}"
-DRONE="${DRONE:-https://drone.ci.commoninternet.net}"
+DRONE="${DRONE:-https://drone.ci.autonomic.zone}"
 CLIENT_ID="${CLIENT_ID:-ab4cdb9d-ee96-4867-875f-87384505fc52}"
 REPO="${REPO:-recipe-maintainers/cc-ci}"
-RES=(--resolve "drone.ci.commoninternet.net:443:127.0.0.1")
+RES=(--resolve "drone.ci.autonomic.zone:443:127.0.0.1")
 export PATH=/run/current-system/sw/bin:"$PATH"
 
 cj=$(mktemp)