Sync the Cluster Domain's apex records and lease from Cloud #1020

Parent

Spec: Hosted DNS, Cluster Domain and wildcard certificates

What to build

One Inngest function sync-cluster-domain keeps the Cluster Domain's apex records and lease correct: triggered by founder enrollment, machine removal, Publish now and an hourly cron per paired Organization. Server Settings shows when the records were last published and which ingress Servers are in the set or were not reachable on port 80.

Acceptance criteria

• Event cluster-domain/sync.requested plus an hourly cron fanning out per Organization; concurrency 1 per Organization; registered in the Inngest policies test.
• Reserves if the row is missing.
• Probes ingress Machines with a public IP via GET http://<ip>/.ployz-verify (must return the Machine id within 5 s) and PUTs the full set.
• A missing runtime frame or an empty probed set never writes records; the lease is still renewed.
• records_synced_at, lease_renewed_at and published are updated; Server Settings renders them per ingress Server.
• Tested with InngestTestEngine, a fake Hosted DNS server and a stubbed runtime and probe.

Blocked by

• Cloud reserves and shows the Organization's Cluster Domain #1019