A rendered public route carries its tier's DNS annotations #579

Parent

Rewrite the spec and the compiler in place, release 1.0.0, and hand over every Project

What to build

A tier declares where its public names point and whether the DNS provider proxies them, and every route rendered for that tier carries the annotations the DNS controller reads. Today the live routes carry external-dns.alpha.kubernetes.io/target and …/cloudflare-proxied by hand; a rendered route carries neither, so a new host would get no record. Found while planning the edge handover (#373, 2026-10-23).

Acceptance criteria

• A tier declares its DNS target and proxied flag.
• Every rendered route on that tier carries both annotations, with the values the live routes use today.
• The chapter states the rule and its refusals, with short rationale only, and CONTEXT.md carries each new term in the same pull request.
• A worked example shows it; its resolved artifact and its rendered tree are updated and reviewed by hand, never regenerated in CI.
• Each refusal has a refusal example with its diagnostics file.
• The JSON Schemas and their corpus admit the new shape and refuse a malformed one.
• The behaviour-ledger row lands with its test, and npm run verify passes.

Blocked by

• Split the compiler's mixed modules by concept, with no change of behaviour