fix(pihole): addn-hosts renders no inline comments

dnsmasq strips ONLY whole-line comments in addn-hosts: a trailing
'# service' on a data line becomes a hostname token. The inventory's
Pi-hole renderer now emits pure IP-name lines (attribution lives in the
inventory) and the tracked file is re-rendered to match; pihole.bats
line-validity seams are green on the rendered artifact.

dankclaw/pihole/addn-hosts

@@ -1,47 +1,43 @@
-# A records for the flat franksdank.name scheme (dnsmasq addn-hosts format:
+# A records for the flat franksdank.cloud scheme (dnsmasq addn-hosts
-# <IP> <name> [<name> ...]). Served by the Pi-hole quadlet (FTL is a
+# format: <IP> <name>). RENDERED — do not edit by hand:
-# dnsmasq fork): the quadlet mounts this file into /etc/pihole/hosts/ read-only.
 #
-# Caddy is consolidated on dankclaw (192.168.0.143): it fronts every service
+#     scripts/service-map.py render pihole-hosts > dankclaw/pihole/addn-hosts
-# on both hosts, so every name resolves to that one IP. Keep in sync with the
-# Caddyfile (tests/pihole.bats cross-checks this).
 #
-#   192.168.0.143 = dankclaw (runs the Caddy container + the AI/dev stack)
+# The source of truth is the `dns:` field of shared/services.yml; the
-#   192.168.0.235 = dankserver (media stack; reached by Caddy via published
+# drift gate in tests/service_inventory.bats fails when this file and
-#                    LAN ports — no DNS records point here)
+# the inventory disagree. Caddy is consolidated on Dankclaw, so every
+# name — including the services running on dankserver and
+# frankbook-pro — resolves at the Dankclaw edge.
+#
+# dnsmasq strips ONLY whole-line comments in addn-hosts: a trailing
+# comment on a data line becomes a HOSTNAME token. No inline notes
+# here; the service attribution lives in the inventory.
 
-# --- Homepage (naked domain + www) + legacy names ---
+192.168.0.143 search.franksdank.cloud
+192.168.0.143 marreta.franksdank.cloud
+192.168.0.143 pihole.franksdank.cloud
+192.168.0.143 ai.franksdank.cloud
+192.168.0.143 gitea.franksdank.cloud
+192.168.0.143 comfyui.franksdank.cloud
+192.168.0.143 seerr.franksdank.cloud
+192.168.0.143 hermes.franksdank.cloud
+192.168.0.143 hermesadmin.franksdank.cloud
+192.168.0.143 prometheus.franksdank.cloud
+192.168.0.143 grafana.franksdank.cloud
+192.168.0.143 loki.franksdank.cloud
+192.168.0.143 auth.franksdank.cloud
 192.168.0.143 franksdank.cloud
 192.168.0.143 www.franksdank.cloud
 192.168.0.143 dankclaw.franksdank.cloud
 192.168.0.143 dankserver.franksdank.cloud
-
-# --- Authentik (SSO / OIDC provider) ---
-192.168.0.143 auth.franksdank.cloud
-
-# --- Media services (dankserver, proxied) ---
-192.168.0.143 plex.franksdank.cloud
-192.168.0.143 plex.franksdank.casa
-192.168.0.143 books.franksdank.cloud
 192.168.0.143 romm.franksdank.cloud
 192.168.0.143 files.franksdank.cloud
 192.168.0.143 jelly.franksdank.cloud
+192.168.0.143 books.franksdank.cloud
+192.168.0.143 plex.franksdank.cloud
+192.168.0.143 plex.franksdank.casa
+192.168.0.143 prowlarr.franksdank.cloud
+192.168.0.143 qbittorrent.franksdank.cloud
 192.168.0.143 radarr.franksdank.cloud
 192.168.0.143 lidarr.franksdank.cloud
 192.168.0.143 readarr.franksdank.cloud
-192.168.0.143 prowlarr.franksdank.cloud
-192.168.0.143 qbittorrent.franksdank.cloud
-
-# --- AI / search / dev services (dankclaw, local) ---
-192.168.0.143 search.franksdank.cloud
-192.168.0.143 comfyui.franksdank.cloud
-192.168.0.143 ai.franksdank.cloud
-192.168.0.143 hermes.franksdank.cloud
-192.168.0.143 hermesadmin.franksdank.cloud
-192.168.0.143 gitea.franksdank.cloud
-192.168.0.143 grafana.franksdank.cloud
-192.168.0.143 prometheus.franksdank.cloud
-192.168.0.143 loki.franksdank.cloud
-192.168.0.143 pihole.franksdank.cloud
-192.168.0.143 seerr.franksdank.cloud
-192.168.0.143 marreta.franksdank.cloud