Remove the ConfigMap, RPZ and managed-directory editors the cluster objects replace

Zones, address redirects, inline rules, lists and groups are cluster objects now
(see the previous commits and deploy/MIGRATION.md), so the mechanisms that held
them are gone:

* internal/kubezones and the resolver's service-account access to a ConfigMap,
  the address-overrides read/write path and its poller, the zone-file poller and
  the Local zones editor with its /api/local-zones routes.
* localzone.Managed, the directory of console-written master files, and the
  blocklist.managed_zones key. The resolver now writes no zone data at all; its
  zone hooks only list. The shared half of that file (the record validator, the
  renderer and the round-trip check) stays as zonestate.go, because DNSZone
  rendering is built on it. Its tests are ported to RenderZone, which keeps the
  coverage of every editable record type, wildcards, relative owners, the
  SOA/NS rule and the delegation rule.
* Tests of the removed write paths: the contract test now builds its zone from a
  DNSZone, and a new test pins that every zone write route on the resolver is
  refused and changes nothing.

Standalone installs keep editing master files on disk and SIGHUP, and the
YAML-backed domain, client, upstream and settings editors, which have not moved.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

AGENTS.md

@@ -59,7 +59,7 @@ Cache is a single shard-local lookup; only a miss touches the network.
 |---|---|---|
 | Scope | Full production | clustering, metrics, ACLs, access log, hot reload, Docker, k8s, CI |
 | Config store | YAML + DNS master files | reviewable/diffable in git |
-| Console-written zone data | Its own directory, `blocklist.managed_zones`, one file per apex | the console is a real operator surface, so it needs somewhere to write; a separate directory keeps the operator's master files read-only to it, and an unset key keeps the console read-only by default |
+| Editable data | Cluster objects (`DNSZone`, `ClientGroup`, `BlockList`, `AddressOverride`, `DomainRule`) written only by `fancy-dns-console`; **no ConfigMap-backed editors, no managed zone directory** | the resolver only reads them (a watch), so it runs anywhere with a kubeconfig, in or out of the cluster. YAML stays for deployment config (listeners, upstreams, cache). The old ConfigMap/RPZ/managed-directory writers are gone |
 | Cluster sync | Valkey (Redis protocol) | simple, mature Go client, easy local dev |
 | Secure DNS | DoT + DoH, **no DNSSEC validation** | deliberately out of scope; AD/CD/extended-RCODE are passed through only |
 | Observability | Prometheus metrics + a JSON access log on stdout; **no in-app dashboard, log store or live tail** | the resolver is DNS only. Charts belong in Grafana, search in the log collector, and per-pod state in a multi-node deployment only disagrees with itself. The access log is blocked/errors by default, goes through a bounded buffer that drops (and counts) rather than ever blocking a query, and nothing may be added to the query path to feed a UI |
@@ -140,11 +140,12 @@ Break these and you break the design, not just the test.
 - **The Go heap does not account for goroutine stacks, runtime metadata, or the
   bbolt mmap.** `memory.reserve` exists to cover them; the cache snapshot is
   mmapped and lives outside the heap entirely.
-- **The zone writer proves its own output.** Every record is validated by the
-  project's own master-file parser, the file is rendered, and the rendering is
-  re-parsed and compared with the records it meant to write *before* the file
-  is renamed into place. A writer bug that lost a record would otherwise show
-  up as a zone that silently stopped answering.
+- **A zone proves its own rendering.** Every record is validated by the
+  project's own master-file parser, the zone is rendered, and the rendering is
+  re-parsed and compared with the records it meant to write *before* it is
+  served (`localzone.RenderZone`, used by both the runtime and the console's
+  `kubesource.CheckZone`). A renderer bug that lost a record would otherwise
+  show up as a zone that silently stopped answering.
 - **A zone the console creates is a real zone.** It is authoritative, so it
   answers NXDOMAIN for the names it does not hold, and `DELETE /api/zones` is
   the only thing that hands a name back to upstream. Deleting a record is not,