fix: dedupe nameservers to stop duplicate-NS 422 on new zones

[ecv]

What

Newly-created DNSZones in prod failed to program: PowerDNS rejected the default NS RRset PATCH with 422 "duplicate record with content", so zones never reached Accepted/Programmed. This blocked every new zone and the infra Integration Chainsaw dns-setup test (#51, Mode 1 — the fleet-wide blocker).

Root cause

The DNSZoneClass NameServerPolicy.Static.Servers list carried each nameserver more than once, and nothing on the path deduped it:

• normalizeStringSlice sorted but kept duplicates → doubled Status.Nameservers (downstream, then mirrored upstream).
• ensureNSRecordSet emitted one NS RecordEntry per (duplicate) entry.
• buildRRSets NS case appended one record per entry → the PATCH carried duplicate NS records → 422.

Trailing-dot variants (ns1.datumdns.net vs ns1.datumdns.net.) made it worse: they only collapse to identical content after qualifyIfNeeded, so a raw-string dedupe alone isn't sufficient.

Fix (three NS-scoped dedupe points)

• normalizeStringSlice — drop duplicate entries. Cleans both downstream and upstream Status.Nameservers at the source (also makes the CR status correct).
• CreateZone — dedupe the apex nameserver list sent at zone creation.
• buildRRSets NS case — dedupe by qualified content, collapsing exact dups and trailing-dot variants right before the PATCH is built. This is the guaranteed 422 fix regardless of what the source list contains.

Scope

Mode 1 (duplicate NS) only, per triage. The other two modes from #51 are tracked as sub-issues and a separate PR:

• Mode 2 — CNAME multi-valued/duplicate content (single-value enforcement + dedupe).
• Mode 3 — ALIAS written where another RRset already exists (conflict handling).

Complementary: #52 surfaces the specific pdns 422 detail into the DNSRecordSet status.

Test

• internal/pdns — TestBuildRRSets_NSDedup: exact dup + trailing-dot variant collapse to one record.
• internal/controller — TestNormalizeStringSlice: duplicates removed.
• go build ./... clean; affected unit tests pass. (The pdns package's Docker/testcontainers integration test is unrelated and not run here.)

Refs #51

🤖 Generated with Claude Code

[ecv]

Superseded by #53, which is the broader fix: its dedupeRecords helper dedupes every record type at the buildRRSets emit boundary plus ReplaceRRSet, and dedupes both normalizeStringSlice and normalizeDomainNameservers. This PR only covered the NS path (CreateZone + the NS case in buildRRSets + normalizeStringSlice), leaving ReplaceRRSet and normalizeDomainNameservers un-deduped. #53 also collapses trailing-dot NS variants (content is already qualified before dedup) and is green on CI. Closing as duplicate; tracking the fix in #53.