verify serials across the nameservers

Ask every nameserver which serial it is actually serving, and whether they agree.

Runs dig SOA for this zone on every nameserver and reports the serial each one is actually serving. Health here is dig, not a status endpoint: serial disagreement is the only failure that matters and it is invisible from the store's own copy, because a push that succeeded on two nodes and silently did nothing on the third looks identical from there. The query runs ON the node against 127.0.0.1, which is a fact about the network rather than a preference: a host cannot reach its own VM's public address (macvlan hairpin), and asking a resolver would answer from a cache. agree is true only when every node answered AND they all gave the same serial. Agreement is checked between the nodes, not against a number computed here : a locally derived serial could be wrong the same way twice. Pass expect_serial (the render's serial) to also assert the push actually took; matches_expected then reports whether the agreed serial is the one just rendered. Each node is {name, host, port, user, key_path, known_hosts_path}: paths only, never key material.