push zone to the nameservers

Replace the live zone file and reload, per nameserver. Only reachable once the check passed on every node.

Writes the rendered zone file to every nameserver and reloads it, reporting per node. IT WILL NOT RUN UNGATED. It requires the results from dnszone_check on the checks pin and refuses unless EVERY node in its own list has a passing check for this zone whose checksum matches a fresh sha256 of the bytes about to be sent. So a parse failure anywhere leaves every node's live file untouched : including the nodes that would have accepted it : and a flow cannot check one file and push another. It also refuses when complete is false (a per-apex slot nobody answered for renders a zone that parses perfectly and is missing a record, which named-checkzone cannot see) and when the file still carries the @SERIAL@ placeholder. Past that gate it is deliberately NOT atomic across nodes: the three servers are independent primaries serving identical files, each validates and swaps on its own, and a node that rejects the file keeps serving what it had. BEFORE WRITING ANYTHING it reads each nameserver's live zone with `dns-push get` and compares record sets: if any record currently being served would disappear, the push is REFUSED and named. named-checkzone cannot catch this : a zone stripped to its SOA and NS parses perfectly and is a total outage : and the store cannot be trusted to say what is live, because a record PATCH that deletes the record and an import that reports success before it lands both produced exactly that. allow_removals lifts the refusal for deliberate deletions and reports them on removed; nothing lifts the refusal on a zone rendered down to SOA+NS. If the live zone cannot be read the push refuses rather than proceeding blind. success is true only when every node applied; otherwise results names which refused and the error says how many of how many landed. Follow with dnszone_verify : agreement between the nodes is the only failure that matters and it is invisible from the store's own copy. Each node is {name, host, port, user, key_path, known_hosts_path}: paths only, never key material.