fix(talos): host DNS asks k8s-gateway first

containerd pulls in-house images from gitea.renner.uno in the host
network namespace, through Talos host DNS. Its only upstream was the
UDM (from DHCP), so every node-level pull of an in-cluster registry
depended on an external DNS.

A ResolverConfig document lists k8s-gateway (10.96.0.11) first and the
UDM second. It replaces the DHCP nameservers. Talos host DNS tries
upstreams in order and moves on after an error or SERVFAIL/REFUSED
(internal/pkg/dns/dns.go); a silent upstream costs the 2 s proxy read
timeout (coredns plugin/pkg/proxy), inside the 4.5 s per-query
deadline, so a cold node still resolves through the UDM until Cilium
and k8s-gateway are up.

Dry run on k8s-1: applies without reboot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kubernetes/talos/patches/site-homelab.yaml

@@ -51,3 +51,13 @@ kind: RoutingRuleConfig
 name: "1001"
 src: 10.244.0.0/16
 table: "47"
+---
+# Host DNS asks k8s-gateway first, so containerd resolves in-cluster names
+# (gitea.renner.uno) in the cluster. The UDM answers while k8s-gateway is not
+# reachable yet; Talos moves on after a 2 s read timeout. This list replaces
+# the nameservers from DHCP.
+apiVersion: v1alpha1
+kind: ResolverConfig
+nameservers:
+  - address: 10.96.0.11
+  - address: 10.2.40.1