docs: record DNS domain move

docs/PACKAGE_BOUNDARY_MIGRATION.md

@@ -248,6 +248,7 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `cabe0e99b` | `spinifex/handlers/sysinstance` | `spinifex/domains/ec2/systeminstance` | System-instance launch is compute ownership; managed services (ELBv2, EKS, RDS, Bedrock) consume the launcher contract. The package was renamed to its directory; runtime `sysinstance:` error strings are unchanged. Managed-service parent metadata is still only the `ManagedBy` tag value, short of the explicit parent metadata the ADR names. Full preflight (excluding the pre-existing containerd advisory), focused daemon and managed-service suites and tagged integration/E2E compilation passed. |
 | `4d86296eb` | `spinifex/handlers/systemvpc` | `spinifex/domains/network/systemvpc` | Managed system-VPC realisation is network ownership; ELBv2, EKS, RDS and Bedrock consume its builder. The package was renamed from `handlers_systemvpc` to its directory and callers dropped the alias; it depends only on foundation packages. Full preflight (excluding the pre-existing containerd advisory), focused system-VPC, daemon and managed-service suites and tagged integration/E2E compilation passed. |
 | `09de514ef` | `spinifex/handlers/imds` | `spinifex/domains/ec2/guestmetadata` | Guest metadata is a compute-domain interface served to guests on each node. The package was renamed from `handlers_imds` to its directory and its vpcd and E2E callers dropped the alias; five path comments were updated. The move exposes dependency-rule breaks it does not repair: imports of the DNS, EC2 instance, EC2 key, IAM and STS implementations, and the first domain-to-runtime edge (`runtime/compute/vm`); see Guest metadata relocation residuals. Full preflight (excluding the pre-existing containerd advisory), focused guest-metadata, vpcd and DNS suites and tagged integration/E2E compilation passed. |
+| `99278d5ff` | `spinifex/handlers/dns` | `spinifex/domains/dns` | DNS control semantics (zone records, resolver and name policy) are DNS-domain ownership, distinct from OVN and host-network realisation. The package name was already `dns`, so callers dropped the `handlers_dns` alias; the multinode E2E test that also imports `miekg/dns` uses `dnsdomain`. Six path comments were updated. The move exposes imports of `runtime/compute/vm`, `network/reconcile` and `bootstrap/config`, recorded in the dependency-rule debt. The `integration,segscanoracle` build fails identically on `origin/dev` (`predastoreS3Client` is in package `integration` but called from `integration_test`) and was not touched. Full preflight (excluding the pre-existing containerd advisory), focused DNS, ACM, guest-metadata, daemon, northstar, admin and CLI suites, `manifest-check` and tagged integration, E2E and E2E bench compilation passed. |
 
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS
@@ -315,6 +316,7 @@ Each needs a consumer-owned capability, projection or versioned contract before
 These residuals were recorded by individual slices and must be resolved once the structural moves are complete, before the dependency lint is enabled.
 
 - Guest metadata: the cross-domain and runtime imports above.
+- `domains/dns`: imports `runtime/compute/vm` (domain-to-runtime), `network/reconcile` for the reconcile lock and `bootstrap/config` for node configuration.
 - ACM: the IAM AES-GCM helper import and gateway-owned action dispatch (ACM relocation residuals).
 - `runtime/roles/northstar`: `BootstrapBaseZone` is DNS control-plane work that belongs to `domains/dns`.
 - `runtime/roles/awsgw`: the quota reconcile loop belongs to `domains/admission/quota`, and the EKS token-verify responder belongs with STS or EKS identity.