prod-readiness: alpine runtime + uid:gid passthrough + git auto-commit working

The final set of fixes to make the rfc2136 plugin truly operational
in production:

- coredns/Dockerfile: switch runtime stage from gcr.io/distroless to
  alpine:3.20. Distroless has no package manager and no shell, so
  `git commit` (called by the plugin's auto-commit code path) had no
  way to execute. Alpine adds ~10 MB image size but gives us git +
  a usable shell for debugging.
- docker-compose.yml: `user: "${COREDNS_UID:-1003}:${COREDNS_GID:-1004}"`.
  The container runs as the host's rpm user (uid 1003/gid 1004 on
  dell01) so zone files the plugin writes are owned by rpm:rpm on
  the host -- not root. Without this the plugin would write
  root-owned files we couldn't read or git-edit. Defaults match
  dell01; override per-host via env if needed.
- .env.example: documents COREDNS_IMAGE_TAG (CalVer; bump per build).
  Add COREDNS_UID/GID if you need to override on a host where rpm
  has different numeric ids.

Combined with the bumped image tag (2026.05.21.2), the full
end-to-end flow works: caddy/nsupdate -> TSIG verify -> plugin
handler -> atomic file write -> git auto-commit -> auto plugin
reload -> query returns new record.

.env.example

@@ -8,7 +8,7 @@ COMPOSE_PROJECT_NAME=coredns
 # Custom CoreDNS image tag (CalVer). Built locally via `docker compose
 # build coredns` using ./coredns/Dockerfile; pulls plugins from the
 # referenced git repos at build time. Bump this when re-rolling.
-COREDNS_IMAGE_TAG=2026.05.21
+COREDNS_IMAGE_TAG=2026.05.21.1
 # Legacy pin (no longer the active image; kept for emergency rollback
 # to upstream CoreDNS if the custom build needs to be reverted).
 COREDNS_IMAGE=coredns/coredns:1.11.3