docs/dns: Add live record reference

Generate forward and reverse record tables from authoritative AXFRs
while preserving handwritten Markdown outside per-zone markers. Run the
generator in CI and link the reference from the relevant docs.

AGENTS.md

@@ -66,8 +66,8 @@ Use the narrowest relevant evaluation while iterating: `check-system <host>` for
 `nix flake check --no-build` for final broad validation or reproducing CI.
 CI builds each attr of `.#ci.x86_64-linux` (systems, homes, packages, shell) and pushes to the
 Harmonia binary cache; see `.gitea/workflows/ci.yaml` and `ci/push-to-cache.sh`. A separate
-workflow (`.gitea/workflows/update-docs.yaml`) regenerates the network-assignment tables and NixOS
-option reference via `nix run .#update-docs-{assignments,options}`.
+workflow (`.gitea/workflows/update-docs.yaml`) regenerates the network assignments, NixOS option
+reference and live DNS reference under `docs/`.
 
 For DNS lookups use **`drill`** (ldns) — `dig` isn't installed in this environment (it fails with
 exit 127, which is easy to miss if stderr is redirected). E.g. `drill -Q @<resolver> <name> A`.
@@ -249,10 +249,12 @@ gets the section with a short explanation instead of a generated-table link.
   Addresses outside that data model (such as external peers or service endpoints) stay with the
   topic that owns them.
 
-**Generated content:** the network-assignment tables in `networking.md` and the option reference
-(`docs/reference/nixos-options.md`) are CI-generated (`nix run .#update-docs-{assignments,options}`)
-— don't hand-edit between the `<!-- ... -->` markers; write the prose and let the updater refresh
-the tables.
+**Generated content:** the network-assignment tables in `networking.md`, the option reference
+(`docs/reference/nixos-options.md`) and the live DNS tables (`docs/reference/dns.md`) are
+CI-generated by the corresponding `update-docs-*` packages; the workflow supplies the DNS zones.
+Don't hand-edit content between `<!-- ... -->` markers; write the surrounding prose or source
+configuration and let the updater refresh the tables. The option-reference file is generated in
+full.
 
 **Keep docs current:** when you add, remove or repurpose a box or service, update its box page, the
 relevant site-index `README.md`, and any affected prose in `networking.md` (the assignment/option