fix(external-dns): unique txt-owner-id per cluster to stop record deletion

[jonathandieu]

Fixes #34.

Problem

external-dns runs on every cluster (the infrastructure appset's clusters: {}
generator) and all instances shared txtOwnerId: dieubernetes against the single
shared dieu.dev Cloudflare zone with --policy=sync. Each instance only sees its
own cluster's HTTPRoutes, so a cluster without a given route treats the records
another cluster created (same owner-id) as "mine but undesired" and deletes them.

Observed: stage created recipes/analytics/changes (A, AAAA, ownership TXT) every
reconcile; platform deleted the same records every reconcile. The records never
survived a cycle, so the hostnames never resolved to the gateway. Both operations
succeed, so nothing was logged as an error.

Fix

Give each cluster a unique owner-id via a per-cluster override, so each instance
manages only its own records:

• clusters/stage-do-atl1/overrides/external-dns.yaml -> dieubernetes-stage
• clusters/platform-do-atl1/overrides/external-dns.yaml -> dieubernetes-platform

prod is not a registered ArgoCD cluster yet, so it runs no external-dns; add the
same override (dieubernetes-prod) when it is registered.

Verify after merge

• platform external-dns stops logging DELETE for recipes/analytics/changes.
• stage's A/AAAA + a-/aaaa- TXT records for those hosts persist in Cloudflare,
  pointing at the Cilium gateway IP, proxied.
• dig recipes.dieu.dev resolves; the sites become reachable by hostname.

Notes

• Root cause is independent of the Envoy Gateway removal (feat(infra): remove leftover Envoy Gateway, complete Cilium cutover #31), which is pure cleanup.
• This also unblocks preview.dieu.dev for the portfolio (Revamp dieu.dev as a platform/SRE/infra portfolio #33).

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.