docs: record pdns PDA removal, us4 firewalld ops, LAN DNS alternatives

- runbooks/pdns-health.md: note the legacy powerdns-admin (PDA) orphan was
  removed 2026-08-12 (W1N-59).
- runbooks/ansible-operations.md: document the us4 firewalld reconciliation
  playbook scope (audited public zone only, fail-closed, no reload).
- docs/agents/domain.md: single-context repo layout for domain docs.
- docs/lan-dns-alternatives.md: notes on LAN DNS alternatives.
- .gitignore: exclude local agent-harness config (.agents/ .claude/ .omp/
  .mcp.json WATCHDOG.yml skills-lock.json) from the repo.

runbooks/ansible-operations.md

@@ -60,6 +60,30 @@ ansible-playbook playbooks/maintenance-preview.yml
 ansible-playbook playbooks/baseline.yml
 ```
 
+## us4 firewalld reconciliation
+
+The us4 playbook owns only the audited `public` zone allowlist. It fails closed
+on unknown services or ports, never reloads/restarts firewalld, and does not
+manage Docker-published ports.
+
+```bash
+cd ansible
+ansible-galaxy collection install -r requirements.yml
+
+# Read-only preview
+ansible-playbook playbooks/us4-firewalld.yml --limit us4 --check --diff
+
+# Apply only after testing the provider console and retaining an independent
+# SSH rollback session.
+ansible-playbook playbooks/us4-firewalld.yml --limit us4 \
+  -e '{"us4_firewalld_confirm": true, "us4_console_confirm": true}'
+```
+
+Apply creates a protected server-local backup and schedules a 15-minute
+automatic rollback before changing rules. The rollback is cancelled only after
+the playbook verifies fresh SSH/sudo access, public HTTPS routes, SMTP, Docker,
+Fail2ban, and WireGuard. Do not bypass either confirmation variable.
+
 ## UniFi SSO login setting (mutating)
 
 Reconciles `super_sdn.sso_login_enabled` on the UniFi controller (host `ubnt`,