atenet/dns: answer non-A actor queries instead of SERVFAIL

[Yuan Gao (ygao-g)]

Fixes #888

The actor DNS zone only answered A; everything else — AAAA for a valid
actor, and any other name in the zone — got SERVFAIL. Strict resolvers treat
that as a hard network error rather than an empty answer, and musl maps it to
EAI_AGAIN, sinking the paired A query with it, so Alpine actors could not
resolve each other even on an IPv4-only cluster.

Valid actor names now return NODATA (NOERROR + SOA) for non-A types, and
anything else in the zone returns NXDOMAIN — both negatively cacheable. This
does not publish an AAAA record; that is #938.

The last two commits cover this end to end. The harness could not query the
zone at all before them: every suite reaches an actor by port-forwarding
atenet-router with a Host header, so what CoreDNS serves went unasserted.

[Yuan Gao (ygao-g)]

Bowei Du (@bowei) Julian Gutierrez Oschmann (@juli4n) mind taking a look?

This is the SERVFAIL half of #246, step one of your three: the actor zone can't
answer AAAA (or any non-A qtype) at all today, which breaks musl clients on
IPv4-only clusters before dual-stack enters the picture. It makes AAAA a correct
empty answer and deliberately stops short of publishing one — the Scope
paragraph spells out why that has to wait for the router's v6 listener, and
Bowei Du (@bowei), that's the sequencing claim I'd most like checked.

Julian Gutierrez Oschmann (@juli4n), the substance is three template blocks in corefile.go and the order
between them. The fallthrough on each block carrying a match is load-bearing
in a way the plugin docs don't make obvious, so TestMakeCoreFile pins the whole
rendered zone as a golden rather than asserting substrings.

Verified against coredns/coredns:1.11.1, the pinned image, not just the
rendered file — details in the Testing section. One known gap filed as #922: the
catch-all NXDOMAINs empty non-terminals, which is latent today but wrong.

[Bowei Du (bowei)]

Yuan -- it would be good to be very specific on what we are doing in this PR. From what I can tell:

• Add support for IPv6 AAAA for Substrate names.
• Fix any associated things needed to get this working.

Is this what you are trying to do?

[Yuan Gao (ygao-g)]

Close, but that's two PRs and this is the smaller one.

This PR doesn't publish an AAAA. It makes the zone return a correct rcode for what it doesn't answer — NODATA for a real actor name on a non-A qtype, NXDOMAIN for a name in the zone that doesn't exist. Both SERVFAIL today, on IPv4-only clusters too, which is why musl-based actors can't resolve each other at all: #888.

Publishing AAAA is #938. The three together:

#874 (this)	the zone can answer a non-A qtype at all
#911	the router Service has a v6 ClusterIP and Envoy is bound on ::
#938	the zone publishes an address record per family the router has a ClusterIP in

Every actor name resolves to the same address — the router ClusterIP, with per-actor demux at Envoy on the Host header — so an AAAA for a Substrate name is those three things, and no one of them is useful alone. End state on dual-stack: an actor name resolves in both families and Envoy answers on either. Each PR carries its own verification; the real gap is that dual-stack isn't testable until #877 lands, so #911's dual-stack behaviour is argued rather than run.

On "fix any associated things" — past DNS, three more sit between a published AAAA and a usable IPv6 path, now filed as step-3 sub-tasks: #943, #944, #945.

[Yuan Gao (ygao-g)]

haiyanmeng Bowei Du (@bowei) PTAL when you have time. Thanks!

[haiyanmeng]

LGTM

Left a comment regarding the test cvoerage

[Bowei Du (bowei)]

Please go through and delete the AI agent self-conversation text. The comments need to be simplified.

[Bowei Du (bowei)]

If we are going to export these, the constants should be located in a package like cmd/atenet/const.

[Yuan Gao (ygao-g)]

Done, but in internal/atenetconsts rather than cmd/atenet/const. PTAL

[Bowei Du (bowei)]

This comment is a mix of describing the implementation and the func purpose.

It should only describe function purpose.

// clusterIPsByFamily gets the Service's cluster IPs split by IPv4 and IPv6.
// If a given family does not exist, the value will be empty string.

This implementation is very complicated, can we do something like this:

// serviceClusterIPs holds the IPv4 and IPv6 cluster IP addresses of a Service.
type serviceClusterIPs struct {
	IPv4 string
	IPv6 string
}

// getServiceClusterIPs extracts the IPv4 and IPv6 ClusterIPs from a Kubernetes Service.
// It handles single-stack, dual-stack, headless, and legacy Service definitions.
func getServiceClusterIPs(svc *corev1.Service) serviceClusterIPs {
	var result serviceClusterIPs
	if svc == nil {
		return result
	}

	// Gather all candidate IPs. Prefer Spec.ClusterIPs (k8s 1.20+),
	// falling back to Spec.ClusterIP for legacy objects.
	ips := svc.Spec.ClusterIPs
	if len(ips) == 0 && svc.Spec.ClusterIP != "" {
		ips = []string{svc.Spec.ClusterIP}
	}

	for _, ipStr := range ips {
		// Ignore headless services or unallocated states
		if ipStr == "" || ipStr == corev1.ClusterIPNone {
			continue
		}

		addr, err := netip.ParseAddr(ipStr)
		if err != nil {
			continue
		}

		if addr.Is4() && result.IPv4 == "" {
			result.IPv4 = ipStr
		} else if addr.Is6() && result.IPv6 == "" {
			result.IPv6 = ipStr
		}
	}

	return result
}

[Yuan Gao (ygao-g)]

Took the struct and the nil guard. Kept !Is4In6(): without it ::ffff:10.96.0.10 files as IPv6. Table case covers it. PTAL

[Bowei Du (bowei)]

Fix the AI generated commit comments as well.