docs: record pdns PDA removal, us4 firewalld ops, LAN DNS alternatives

- runbooks/pdns-health.md: note the legacy powerdns-admin (PDA) orphan was
  removed 2026-08-12 (W1N-59).
- runbooks/ansible-operations.md: document the us4 firewalld reconciliation
  playbook scope (audited public zone only, fail-closed, no reload).
- docs/agents/domain.md: single-context repo layout for domain docs.
- docs/lan-dns-alternatives.md: notes on LAN DNS alternatives.
- .gitignore: exclude local agent-harness config (.agents/ .claude/ .omp/
  .mcp.json WATCHDOG.yml skills-lock.json) from the repo.

.gitignore

@@ -15,6 +15,14 @@ id_*
 .ansible/
 facts/
 
+# Local agent-harness / tooling config (not repo content).
+.agents/
+.claude/
+.omp/
+.mcp.json
+WATCHDOG.yml
+skills-lock.json
+
 # Editor and operating-system files.
 .DS_Store
 .vscode/