Adopt existing Email DNS without changing routing #65

🤖 Generated by the Agentic Engineer

Objective

Bring the existing Email DNS records into the repository's authoritative state while preserving current routing and provider configuration.

Context

#63 is delivered: the first confirmed native proposal passed and its encrypted capture was independently authenticated. The proposal imports locally only; it does not update authoritative state. This continuation must preserve the existing state lineage and leave every DNS record unchanged.

Acceptance criteria

• Use the reviewed DNS selection and complete fresh provider inventory; refuse ownership conflicts, drift or an unexpected resource set.
• Plan native configuration-driven imports against the existing backend. Admit only the exact selected imports and unchanged existing resources; reject all provider creates, updates, deletes and replacements.
• Execute the reviewed saved import plan once through the confirmed main-only workflow, with native locking and unchanged state lineage.
• Retain independently recoverable encrypted state and complete desired configuration before and after the operation, including unsuccessful or partial outcomes; verify permanent ciphertext publication.
• From a separate clean operator environment, recover configuration and state and require a native plan with no remaining imports or provider changes.
• Complete affected tests, current-head CI/review, protected merge, confirmed native execution and independent capture verification before closing this issue.

Boundaries

This changes state ownership only. Moving Email routing, activating mail transport, changing service credentials and enabling general provider applies remain separate acceptance work. The prior proposal is evidence, never authority to replace the existing state.

Part of #21; continues #63 and supports devantler-tech/platform#5481.