`[2026-09-23]` headscale-ddns hardened

headscale-ddns hardened (fedd4b6): Cloudflare calls retry and validate every body (pick()), no write without both IDs, the run ends on a confirmation, only a global v4 is published, curl -q. Three of four weekly failures were empty zone lookups. heid bug-hunt "Talus" folded (one finding was my own regression).