test(gateway): add the port a ZT domain needs, and cover the CAA guard rerun - #1146

Draft. The port fix is right and the CAA case is written and proven to
discriminate, but the suite is not green yet — see Status.

The suite's dns-01 half has not been running

Phase 4 adds the dns-01 domains without a port:

-d '{"domain": "'"${domain}"'"}' > /dev/null || true

The server refuses that — proto_to_zt_domain_config requires 1..65535 — and
|| true swallowed it. So test0.local and friends were never configured, and
every assertion downstream of them failed. The gateway says so plainly once you
look:

CAA records reconciled for 0 domains (3 on dns-persist-01 left to the operator)

Three domains, all the dns-persist-01 ones added by Phase 10. That is 22 of
the suite's assertions failing for long enough that the count reads as a
property of the environment. It is not — there was nothing there to fail.

This is pre-existing: the port check is on next, not from this stack.

The port is supplied, and the swallow becomes a warning so the next breakage
announces itself.

What that unblocks

A SetCaa run that dies between installing the ; guards and dropping them
leaves them behind, and the operator is told to rerun. The rerun has to work,
and it has to get there without ever lifting the deny-all — a name with no
issuer CAA is not "denied" but "any CA may issue".

Both reusing the stranded guard and deleting it to add a fresh one end with the
same records. Only one of them stays denied throughout, and the gap is
invisible once the replacement finishes. So the mock records names whose issuer
CAA set emptied out, and the test asserts the domain is not among them.

The stranded state is planted directly — that is exactly what a dead run left —
so this needs no way to kill a run midway.

Status

• The port fix is verified against the gateway's own log.
• The CAA case fails against delete-then-add and passes against adoption
  when driven by hand, so it discriminates rather than passing vacuously.
• It is not yet green inside the full suite. Reviving 22 assertions that
  have never run turns up more than one layer, and the remaining ones are still
  being unwound. Draft until it is.

Base

Third in a stack: #1132 → #1144 → this. Merge in order.