A cert-manager DNS01 challenge keeps creating TXT records in the wrong zone

Automation is healthy, yet the challenge lands in the parent zone because two controllers normalize the target name differently.