Remove Hosted DNS from the daemon, SDK and CLI #1024

Parent

Spec: Hosted DNS, Cluster Domain and wildcard certificates

What to build

The daemon, SDK and CLI carry no Hosted DNS: no DNS RPCs, no reservation row, no generated-domain field in the runtime watch frame, and no cluster-domain hostname type. Only explicit hostnames exist in core. Caddy's /.ployz-verify handler stays for Cloud's probe.

Acceptance criteria

• Removed: the Hosted DNS client, the hosted_dns row and store functions, ReserveDomain/GetDomain/ReleaseDomain/CreateDomainRecords and their types, hosted_dns_hostname in the watch frame and SDK payloads, IngressHostname::ClusterDomain and its label type, core managedHostnames lowering (managedHostnames stays in the core-owned authored environment document, because Cloud's parse, diff, review and restore all run through it; core lowering refuses a non-empty list, and Cloud expands it to explicit hostnames before lowering).
• Removed from the CLI: the dns command, --no-dns, --dns-endpoint, machine add/remove DNS refresh and the probe; --no-dns removed from qualification scripts.
• Removed tests: the Hosted DNS layer-3 suite and its runner entry, fake DNS RPCs in the cloud-init harness; contract and capability tests updated.
• Kept: the /.ployz-verify handler and INGRESS_VERIFY_PATH, ClusterDnsVerdict, the internal .internal DNS server.
• core/CONTEXT.md: Hosted DNS and Ingress Hostname rewritten to match; Certificate Material gains published and wildcard semantics.

Blocked by

• Expand managed hostnames from the Cluster Domain row, not the runtime frame #1021
• Freeze the 1.0 CLI Cluster command tree #988