DNS checkpoint recovery

Scheduled DNS fetches retain a failed container rollback checkpoint and report the activation failure. Inspect the resolver's current accepted manifest and served UDP/TCP answers before attempting recovery. Do not delete the checkpoint or create a replacement OpenBao publication or identity.

When an obsolete rollback can no longer pass acceptance, explicitly recover against the existing scoped, approved DNS source. Make a private 0600 copy of the host's .state/enclavr-dns/openbao/fetch.json and add "recover_dns_checkpoint": true to that copy. Keep the scheduled request unchanged. Run:

./enclavr internal openbao-ops --request-file /absolute/private/recovery.json --apply

Recovery holds the normal fetch lock and preserves the original checkpoint byte-for-byte in a private dns-container-rollback-preserved-*.json file before changing the resolver. It accepts only the approved source, verifies answers over UDP and TCP, rechecks source generation and identity, and updates host acceptance state before removing the blocking checkpoint. Any failure retains the checkpoint for investigation and retry. Repeating successful recovery is a no-op.

Restart the existing DNS-fetch service and confirm its normal timer succeeds. Keep the preserved checkpoint as incident evidence; remove the temporary recovery request after verification.