pihole: also neutralize the /etc/sysctl.conf sysctl override

systemd-sysctl applies /etc/sysctl.conf AFTER all of sysctl.d/, so the
stale ip_unprivileged_port_start=80 line there beat every drop-in and kept
the runtime value at 80 after the first deploy pass. deploy_pihole now
comments out an active line in /etc/sysctl.conf (idempotent) and generalizes
the sysctl.d conflict scan to any file setting a value above 53.

tests/pihole.bats

@@ -62,6 +62,12 @@ HOSTS="$PIHOLE_DIR/addn-hosts"
     grep -q 'sysctl --system' "$REPO_ROOT/scripts/deploy-remote.sh"
 }
 
+@test "deploy_pihole neutralizes the sysctl.conf override (processed after sysctl.d)" {
+    # systemd-sysctl applies /etc/sysctl.conf LAST, so a stale line there
+    # beats every drop-in. The 2026-08-26 port-53 outage had one.
+    grep -q '/etc/sysctl.conf' "$REPO_ROOT/scripts/deploy-remote.sh"
+}
+
 @test "the pihole env example has placeholder values only" {
     [ -f "$ENV_EXAMPLE" ]
     grep -q '^WEBPASSWORD=changeme$' "$ENV_EXAMPLE"