nixos/castle: Pin static DNS on lan-hi

castle took its resolver solely from the IPv6 RA (radvd RDNSS) on
lan-hi, so DNS broke whenever RA was absent. Since castle's own v6 is
RA/SLAAC-derived it has no usable v6 address in that case, so anchor
DNS on the always-present static v4 via the VRRP VIP, with the v6 VIP
as a bonus when v6 is up. Search domains reuse the centralised
lib.my.c.home.searchDomains list.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nixos/boxes/home/castle/default.nix

@@ -2,7 +2,7 @@
 let
   inherit (lib.my) net;
   inherit (lib.my.c) networkd;
-  inherit (lib.my.c.home) domain vlans prefixes vips roceBootModules;
+  inherit (lib.my.c.home) domain searchDomains vlans prefixes vips roceBootModules;
 in
 {
   nixos.systems.castle = {
@@ -189,8 +189,16 @@ in
               };
               "40-lan-hi" = mkMerge [
                 (networkdAssignment "lan-hi" assignments.hi)
+                {
+                  networkConfig = {
+                    # v6 is RA/SLAAC-derived, so when RA is absent we have no v6 at all;
+                    # anchor DNS on the always-present static v4 (the VRRP VIP follows the master)
+                    DNS = [ vips.hi.v4 vips.hi.v6 ];
+                    Domains = searchDomains;
                     # So we don't drop the IP we use to connect to NVMe-oF!
-                { networkConfig.KeepConfiguration = "static"; }
+                    KeepConfiguration = "static";
+                  };
+                }
               ];
               "45-lan-lo" = {
                 matchConfig.Name = "lan-lo";