Schedule fancy-dns on amd64 nodes

The published image is built for amd64 only, but the StatefulSet had no architecture constraint and could be scheduled on arm64 nodes. Restrict pods to Kubernetes amd64 nodes so every replica can run the image.

deploy/k8s/10-deployment.yaml

@@ -35,11 +35,12 @@ spec:
         reloader.stakater.com/auto: "true"
     spec:
       serviceAccountName: fancy-dns
+      nodeSelector:
+        kubernetes.io/arch: amd64
       imagePullSecrets:
         - name: reg-k6n
-      # No hostNetwork. The server does not set SO_REUSEPORT, so a second
-      # host-network pod would fail to bind :53 and crash-loop; the ports are
-      # served by a LoadBalancer Service instead (see 20-service.yaml).
+      # The pod listens on high ports; Services expose the standard DNS ports.
+      # No hostNetwork, so replicas can share nodes without port collisions.
       dnsPolicy: ClusterFirst
       # The app drains in-flight queries for up to 15s on SIGTERM (see the
       # shutdown timeout in cmd/fancy-dns/main.go); give it room beyond that.