C1/C2/M9: tighten security boundary at handleUpdate

C1 — Document the process-global MsgAcceptFunc mutation:
CoreDNS 1.14.3 doesn't expose per-Config MsgAcceptFunc (server.go:159
hardcodes the dns.Server struct), so the override has to be global. The
init()-level comment now explains the operational consequences in
detail, and setup() emits a loud INFO log calling out the global scope
for operator audit. Upstream support for per-Config MsgAcceptFunc would
let us delete the whole stanza.

C2 — handleUpdate now requires the caller to assert TSIG verification
via an explicit `verified bool` parameter. The security contract is
encoded in the function signature, not in convention. ServeDNS passes
verified=true after checkTSIG succeeds; verified=false produces an
immediate Refused with no state mutation. Future internal callers
(NOTIFY relay, admin RPC, refactor) physically cannot reach the
mutation code without proving the request was authenticated.

M9 — Don't sign TSIG-failure rejection responses. Per Hamilton's
finding, signing a rejection with the named key attests "yes, this
server holds that key" — useful intel for an attacker probing key
existence. Unsigned Refused is the right shape: nsupdate sees "no TSIG
on reply" and treats as auth failure, which is what actually happened.

New test TestUpdate_UnverifiedCaller_Refused proves the C2 contract:
handleUpdate(w, msg, false) refuses, zone file unchanged.

update_test.go

@@ -55,11 +55,14 @@ func newUpdate(zone string, updates ...dns.RR) *dns.Msg {
 }
 
 // runUpdate sends msg through the handler with TSIG auth bypassed
-// (calling handleUpdate directly instead of ServeDNS).
+// (calling handleUpdate directly with verified=true instead of
+// ServeDNS). Tests that exercise post-auth logic use this; tests that
+// assert auth-failure behavior should call handleUpdate(w, msg, false)
+// directly.
 func runUpdate(t *testing.T, p *RFC2136, msg *dns.Msg) (rcode int) {
 	t.Helper()
 	w := &captureWriter{}
-	rcode, _ = p.handleUpdate(w, msg)
+	rcode, _ = p.handleUpdate(w, msg, true)
 	return rcode
 }
 
@@ -152,6 +155,29 @@ func TestUpdate_DeleteRRset_RemovesAllOfType(t *testing.T) {
 	}
 }
 
+// TestUpdate_UnverifiedCaller_Refused proves the C2 defense-in-depth
+// contract: handleUpdate refuses any call that doesn't assert TSIG
+// verification, even if the rest of the message is well-formed and the
+// zone is authoritative. This guards against a future internal caller
+// that bypasses the wire-level TSIG check in ServeDNS.
+func TestUpdate_UnverifiedCaller_Refused(t *testing.T) {
+	p := newTestPluginWithZone(t, "auth.example.com")
+	upd := newUpdate("auth.example.com",
+		mustRR(t, `foo.auth.example.com. 60 IN TXT "should-not-apply"`),
+	)
+	w := &captureWriter{}
+	rcode, _ := p.handleUpdate(w, upd, false) // <- the security boundary
+	if rcode != dns.RcodeRefused {
+		t.Errorf("rcode = %d, want REFUSED for unverified caller", rcode)
+	}
+	// Zone file must NOT have been modified.
+	for _, rr := range readZoneRecords(t, p, "auth.example.com") {
+		if txt, ok := rr.(*dns.TXT); ok && txt.Hdr.Name == "foo.auth.example.com." {
+			t.Errorf("unverified UPDATE applied state mutation: %s", rr.String())
+		}
+	}
+}
+
 func TestUpdate_OutOfZone_Refused(t *testing.T) {
 	p := newTestPluginWithZone(t, "auth.example.com")
 
@@ -279,7 +305,7 @@ func TestUpdate_SignedRequest_ResponseGetsTSIG(t *testing.T) {
 	upd.SetTsig("acme-update-key.", dns.HmacSHA256, 300, 0)
 
 	w := &captureWriter{}
-	if _, err := p.handleUpdate(w, upd); err != nil {
+	if _, err := p.handleUpdate(w, upd, true); err != nil {
 		t.Fatalf("handleUpdate: %v", err)
 	}
 	if w.msg == nil {
@@ -309,7 +335,7 @@ func TestUpdate_UnsignedRequest_ResponseStaysUnsigned(t *testing.T) {
 	// No SetTsig — request is plain.
 
 	w := &captureWriter{}
-	if _, err := p.handleUpdate(w, upd); err != nil {
+	if _, err := p.handleUpdate(w, upd, true); err != nil {
 		t.Fatalf("handleUpdate: %v", err)
 	}
 	if w.msg.IsTsig() != nil {