render zone file

Render a complete BIND zone file from stored records, with the decision report that belongs in front of a push.

Renders stored records into a complete BIND zone file on zone_file. PURE: no network, no server, no writes : same store state, same bytes apart from the serial. That separation is what makes a resync a re-render instead of a diff-repair, and what lets the UI show exactly what will land before anything does. ONE BLOCK, TWO SHAPES. Given records alone, it renders that zone. Given base_zone as well, the records are a zone GROUP's and this apex is a member: group semantics run first and the composed set comes back on the records pin. In a group, each value takes the first matching entry in rules ({action, owner, type, value_contains, slot, why}; a missing field is a wildcard), falling back to the record's own policy : 'verbatim' (default), 'rewrite' (re-aim a target naming the base apex at this member's, REFUSING if it changed nothing), 'per-apex' (drop the base value; the record becomes a slot this member fills from its own records) or 'note' (copy but flag). overrides are this member's own slot fills, extra are records existing only on this apex, slots_na is {slot: reason}. A slot neither filled nor in slots_na is EMPTY: complete comes back false and, with strict on, the render is refused. ALIAS has no BIND equivalent and the two cases differ completely. An IN-ZONE target (deverence.com -> www.deverence.com) is answered from the zone's OWN RECORDS: deterministic, no resolver, never stale, and it REFUSES if the target names nothing in the zone rather than emitting a record that is silently missing. An OUT-OF-ZONE target (an ELB, a CloudFront name) needs a live lookup, so it requires flatten_alias and comes back with a resolved_at timestamp, because it goes stale when the target moves. The apex NS set becomes the zone's existing nameservers PLUS our_nameservers (default the canonical trio). The serial is the epoch at render time unless a serial is passed.