fix(gateway): retain admitted DNS intent through observation gaps

[reoring]

Summary

• Preserve only previously admitted DNS bindings through missing/Unknown route observations or temporary Gateway address loss.
• Store exact route UID/generation, Gateway UID/class, parent/listener identity and listener digest in the managed EndpointRecordSet admission receipt. Do not grant new hostnames or binding receipts without current acceptance and addresses.
• Current explicit route/Gateway rejection, removed topology, and identity replacement revoke the affected claims. Historical receipt discovery keeps old-Gateway cleanup reachable after parent removal or route disappearance.
• Keep repeated no-address reconciliation stable without allowing another route sharing a hostname to inherit admission. Dynamic namespace-selector retention remains fail-closed, without new RBAC.
• Keep endpoint/provider ownership and finalization unchanged; update the existing design contract.

Verification

Development-only with real Gateway/EndpointRecordSet reconcilers and fake Kubernetes storage:

• Original cb8b8dd source fails the Payment/HA shared-DNS retention regression; fixed source passes.
• Gateway and endpoint controller packages pass, including explicit rejection, identity changes, detached-parent cleanup, same-hostname admission isolation, repeated address loss, and recovery.
• Focused go vet and golangci-lint pass; gofmt and git diff --check pass.
• Focused independent security review completed; all reported blockers resolved.
• No live Route 53/Cloudflare calls, cluster mutation, release tags, artifact publication, or provider certification.

Required adoption order

Depends on the Platform status-producer correction in https://github.com/appthrust/platform/pull/3632. Adopt that Platform producer first, then this DNS consumer, so explicit rejection is not mistaken for an observation gap. Opening this PR does not request merge or live deployment. Historical exact outage inputs remain unproven.