Schedule fancy-dns on amd64 nodes

The published image is built for amd64 only, but the StatefulSet had no architecture constraint and could be scheduled on arm64 nodes. Restrict pods to Kubernetes amd64 nodes so every replica can run the image.

deploy/k8s/10-deployment.yaml

@@ -35,11 +35,12 @@ spec:
         reloader.stakater.com/auto: "true"
     spec:
       serviceAccountName: fancy-dns
+      nodeSelector:
+        kubernetes.io/arch: amd64
       imagePullSecrets:
         - name: reg-k6n
-      # No hostNetwork. The server does not set SO_REUSEPORT, so a second
+      # The pod listens on high ports; Services expose the standard DNS ports.
-      # host-network pod would fail to bind :53 and crash-loop; the ports are
+      # No hostNetwork, so replicas can share nodes without port collisions.
-      # served by a LoadBalancer Service instead (see 20-service.yaml).
       dnsPolicy: ClusterFirst
       # The app drains in-flight queries for up to 15s on SIGTERM (see the
       # shutdown timeout in cmd/fancy-dns/main.go); give it room beyond that.