An ExternalDNS rollout updates public records and one cluster path still flaps

DNS writes succeed, but ownership tracking in the private zone keeps undoing one cluster's intended state.