validate zone on the nameservers

Run named-checkzone on every nameserver. Writes nothing anywhere, on any node.

Runs named-checkzone for this zone file on EVERY nameserver in the nodes list and reports per node. It never writes: the file is handed to the parser on stdin and discarded. This is a separate fan-out ahead of any write, not a per-node try-and-see, because a DNS server serving a syntactically valid but truncated zone is worse than one serving yesterday's : so 'does this parse everywhere' is answered in full before 'shall we replace anything' is asked. passed comes back true only when every node passed. results carries {name, host, ok, output, exit_code, checksum, zone} per node, and checksum is a sha256 of the exact bytes checked: dnszone_push demands a passing result with a MATCHING checksum for every node it is about to write to, so a flow cannot render, check, edit and then push a different file. Each node is {name, host, port, user, key_path, known_hosts_path}. Key MATERIAL must never appear on the pin : only paths : and the block refuses a node object carrying private_key, key, password, passphrase or secret. Refuses a file still carrying the @SERIAL@ placeholder, since those would not be the bytes pushed.