fix: Stop respelled owner names deleting live PowerDNS RRsets

[aflor024]

Summary

PowerDNS keys an RRset on a single absolute name, but the reconcile queue is keyed on the raw owner name from the spec. api, api.example.com. and @ at the apex all qualify to the same RRset, and the DNSRecordSet update handler enqueues both ObjectOld and ObjectNew — so rewriting an owner name produces two requests for one RRset. The request carrying the retired spelling finds no owning DNSRecordSet, falls into the cleanup branch, and deletes what the live request just wrote. The record vanishes from PowerDNS while the DNSRecordSet still reports Programmed=True, and with no periodic requeue on this reconciler it stays gone until the next watch event.

Both delete paths are now guarded: the RRset is only deleted once no other spelling of the owner name still claims it. The spelling being reconciled is excluded from that check, so an owner name that was genuinely removed still gets cleaned up.

This is reachable in production today — Gateway DNS moved to relative owner names shipped in network-services-operator v0.24.8 with enableDNSIntegration on in staging and production, so every gateway-managed record undergoes exactly this rewrite once.

Second change: a PowerDNS coexistence 422 no longer comes back as a reconcile error. It isn't transient — the record is well-formed but cannot share the name with data already there, so exponential retry can never clear it and only pins ControllerReconcileErrorRatioCritical high for this controller. It now requeues on a long interval instead. A slow poll rather than a terminal result, because the conflicting RRset may be removed outside Kubernetes with no watch event to wake us. Status still carries Programmed=False with reason Conflict, which is what #57 added.

QualifyOwner is exported so the controller can compare owner-name spellings for RRset identity, and NewAPIError so code outside the package can construct the error shapes IsConflict and FriendlyMessage already classify.

Note

This reduces the error ratio for conflicts and stops the data loss, but it does not stop the conflicts happening. The dual-write that creates them is network-services-operator#316.

Test plan

• Retired owner-name spelling does not delete the live RRset, asserted in both queue orderings
• Apex spellings alias correctly — @ and the absolute zone name are one RRset
• A genuinely removed owner name still deletes its RRset (no over-blocking)
• Coexistence 422 requeues without a reconcile error and reports Programmed=False/Conflict
• All four new tests fail against main without this change
• go test ./internal/controller/... ./internal/pdns/... (unit; the envtest suite needs local etcd/apiserver binaries)
• golangci-lint run clean on v2.4.0, the version CI pins
• Verify in staging that a gateway hostname surviving an owner-name rewrite keeps its RRset

Fixes #74
Related to #56
Related to #51

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}