refactor: strip libdns + admincli + dns packages + remove dns_record step (Phase 3b)

[intel352]

Summary

Phase 3b of cross-repo DNS cascade. workflow-plugin-infra becomes a thin abstract-module-types-only plugin. Pairs with PR 7 in workflow (already merged): the dns-policy commands, dns/policy + dns/gate + dns/audit packages, and OnBeforeAction hook all live in workflow now.

Two commits:

1. `refactor: delete admincli + dnspolicy/gate/audit/provider packages` — Task 26 (5 dirs, 24 files removed).
2. `refactor: strip infra.dns_record step + DNSRecordStepConfig proto + libdns deps; bump v1.0.0` — Tasks 27+28+29.

Changes

What	Why
DELETE `internal/admincli/`	Relocated to wfctl `dns-policy` builtin in PR 7
DELETE `internal/dnsprovider/`	libdns adapters no longer needed — wfctl drives via strict-contract ResourceDriver
DELETE `internal/dnspolicy/`	Relocated to `workflow/dns/policy/` in PR 7
DELETE `internal/dnsgate/`	Relocated to `workflow/dns/gate/` in PR 7 (with ResourceDriver adapter)
DELETE `internal/dnsaudit/`	Relocated to `workflow/dns/audit/` in PR 7 (with path migration)
REMOVE `infra.dns_record` step type	Peer-dispatch from a step-handler context is architecturally unsupported (cycle 3.5 I-NEW-1)
REMOVE `DNSRecordStep{Config,Input,Output}` proto messages	Step type removed; regenerated `infra.pb.go` via protoc
REMOVE `infra-dns` cliCommand	Relocated to wfctl `dns-policy` builtin in PR 7
DROP `libdns/*` + `workflow-plugin-hover` go.mod deps	No remaining consumers post-strip
REMOVE deprecated infra.dns Start gate	Pointed at the now-removed infra.dns_record step; module is once again abstract
BUMP plugin.json version 0.0.0 → 1.0.0	Capability surface shrunk + proto contract broke → major bump per semver

Test surface delta

• Deleted `internal/contracts/infra_dns_record_test.go` (referenced removed proto types).
• Replaced 4 step-type-asserting tests with two new tests pinning the post-Phase-3b invariant: `TestPlugin_StepTypes_EmptyPostPhase3b` + `TestContractRegistry_HasNoStepContractsPostPhase3b`.

Verification

```
GOWORK=off go build ./...
GOWORK=off go test ./...
```

Both green. `grep` for any remaining `workflow-plugin-infra/internal/{admincli,dnsprovider,dnspolicy,dnsgate,dnsaudit}` import returns zero in-repo hits.

Rollback

Revert THIS PR first, then PR 7 (workflow#787) — order matters. After both reverted, libdns + admincli code restored from git history; system back to pre-Phase-3 state via the old plugin cliCommand surface.

Runtime validation

Post-merge, when workflow-plugin-infra v1.0.0 is published + the workflow-registry pin-bumped, verify:

• `wfctl plugin verify-capabilities ./bin/workflow-plugin-infra` passes (no step types, no cliCommands)
• `wfctl infra apply` continues to work for infra.* modules via host-resolved IaC providers
• `wfctl dns-policy show --provider

  --zone ` works through the new builtin

Part of cross-repo cascade

`docs/plans/2026-05-26-dns-provider-contract.md` (this repo). PR 8 of 9. After merge + v1.0.0 tag, the workflow-registry pin-bump PR is the final step of Phase 3.

Test plan

• `GOWORK=off go test ./...` green
• `GOWORK=off go build ./...` clean
• No remaining imports of removed packages

🤖 Generated with Claude Code