feat: track full CoreDNS Deployment manifest, add topologySpreadConstraints

CoreDNS is Talos-bootstrapped and previously untracked except for its
ConfigMap. Pull the full live spec into one file as the single source of
truth, add topologySpreadConstraints so the 2 replicas don't land on the
same node. ScheduleAnyway (not DoNotSchedule) to avoid blocking scheduling
if a node is briefly unavailable.

helmfile.yaml.gotmpl

@@ -160,6 +160,7 @@ releases:
             # otherwise services stay <pending>. Apply it here as the first hook.
             kubectl apply -f k8s/cilium/lb-ipam-pool.yaml
             kubectl apply -f k8s/coredns/coredns-configmap.yaml
+            kubectl apply -f k8s/coredns/coredns-deployment.yaml
             kubectl rollout restart deployment/coredns -n kube-system
             kubectl rollout status deployment/coredns -n kube-system --timeout=60s
             # Wildcard TLS cert — must exist before nginx starts so it can read the secret.