fix(e2e): mark the Domain verified before asserting a zone provisions

[scotwells]

Five chainsaw suites have been red on main since #100. Last green run repo-wide was 2026-08-14.

What broke

#100 added a gate that refuses to provision DNS until the requester has proven they own the domain:

Never provision DNS for a domain the requester hasn't proven they own. Without this gate, any syntactically valid domain name gets a live PowerDNS zone immediately, letting a tenant claim (and serve real traffic for) a domain someone else already controls.

That gate is right. But the tests were never taught the new precondition, so five suites sit waiting for a verification that nothing in a kind cluster can perform, and the operator logs domain not yet verified; deferring DNS provisioning until they time out.

The fix

Each affected test now marks its Domain verified between creating the DNSZone and asserting it provisions:

- name: Mark the Domain verified
  try:
  - assert:                     # the operator creates it
      resource: {apiVersion: networking.datumapis.com/v1alpha, kind: Domain, metadata: {name: example.test}}
  - script:                     # the harness supplies what a real tenant proves
      content: kubectl patch domain example.test -n "$NAMESPACE" --subresource=status ...

The operator creates the Domain itself and watches it, mapping changes back to the zone in the same namespace with a matching spec.domainName — so patching the Verified condition re-enqueues the zone and the rest of each test proceeds unchanged.

This asserts the precondition rather than working around the gate. The tests now reach the same state a real tenant reaches after completing ownership verification, and a regression in the gate would still fail them: a zone that provisioned before the patch step would break the ordering the steps encode.

Affected suites

activity-display · alias · display-annotations · full-chain · zones-and-records

federation is deliberately untouched. It creates its DNSZone on the control cluster, which runs the agent rather than the replicator — so it has neither the domain gate nor the networking CRDs installed. It passes on main and still passes.

Verification

All six pass chainsaw lint. The suites themselves need a kind cluster, so CI on this PR is the real check — this fix is the only change on the branch, so a green E2E here is unambiguous evidence.

🤖 Generated with Claude Code

[kevwilliams]

Sorry I broke this :| I think I saw the test fail and meant to go fix it but I forgot.