fix(ci,kubenuc): derive CoreDNS test-hosts and DNS checks from live Ingress objects

[dark-vex]

Summary

• validate-kubenuc.yml's "Configure CoreDNS and hosts for test domains" step built a CoreDNS hosts override from a hardcoded 9-entry placeholder-domain list, but the Robot Framework ingress suite (tests/robot/robot-test-job.yaml, discover_ingresses()) tests the real hostnames read off live Ingress objects — so the override never matched what was actually being resolved, and every kubenuc PR's cluster-test job has been failing with net::ERR_NAME_NOT_RESOLVED since 2026-08-09 (confirmed via 5 consecutive failing runs across unrelated Renovate PRs, so not caused by any single PR's content).
• The "Verify DNS resolution in cluster" step was a false-green guard for the same reason: it only nslookup'd the 3 hardcoded placeholder names (which always resolved against the override) and swallowed all failures with || echo "DNS test completed".
• Both steps now derive the host list at runtime via kubectl get ingress -A -o json | jq ..., mirroring exactly what discover_ingresses() reads, so the CoreDNS override and the actually-tested hosts always agree. No domain — placeholder or real — is hardcoded anywhere in the workflow anymore, and the DNS-verification step now actually fails the job on a real resolution failure instead of being a no-op.

Test plan

• git diff reviewed; YAML validated (check-yaml pre-commit hook + yaml.safe_load)
• Both changed shell blocks simulated locally (mock kubectl/jq output) to confirm the generated ConfigMap YAML and the per-host nslookup script are well-formed for single-host, multi-host, and empty-host-list cases
• Independent review from Codex and Fable against the same scoped question (host-list coverage vs discover_ingresses(), jq/bash portability, empty-list-masking-a-real-failure risk); both confirmed findings folded back in:
  • added set -o pipefail so a kubectl get ingress failure can't be silently misread as "no ingresses found"
  • preserved the CoreDNS-logs diagnostic dump on DNS-check failure (previously always ran; now captured and reported before failing the step)
• cluster-test job green on this PR (no ERR_NAME_NOT_RESOLVED), verified via gh run view --log
• Re-run/rebase the currently-blocked kubenuc PRs (e.g. chore(deps): update redis Docker tag to v28.0.2 #1833) after merge to confirm they go green too