fix(tls): wait for DNS before ACME issuance

What changed

• wait for every routed hostname to resolve publicly before requesting its first HTTP-01 certificate
• bound the wait to 24 attempts at five-second intervals
• keep scheduled renewals nonfatal while DNS is unavailable
• make the deploy path verify every expected certificate file after the renewal unit runs
• add deployment and generated-script regression coverage

Why

The compute deploy reconciles DNS before starting the rpx certificate unit, but provider acknowledgement does not mean recursive resolvers can see a brand-new record. On a first deploy, Let’s Encrypt could receive NXDOMAIN while Route 53 was still propagating. The renewal unit treated that failure as nonfatal, so ts-cloud reported success and left the gateway serving an unrelated fallback certificate until the daily timer ran.

The DNS wait closes that race, and the post-unit certificate checks make deployment status reflect the actual TLS outcome.

Validation

• 95 focused compute-deploy and rpx-gateway tests
• bun run lint
• bun run typecheck