feat: Show the DNS records still to publish in alb describe

[scotwells]

Summary

The datumctl alb plugin checks hostnames with the operator's own rules before sending them, so it refused every wildcard, and describe gave no way to see which DNS records a hostname still waits on.

The plugin now accepts a hostname with one leading wildcard label and leaves the platform to decide whether wildcards are enabled and proven.

describe prints the records still to publish from the load balancer's status, including the certificate record, and its "DNS not delegated" hint now points at that certificate record.

This is stacked on #531.

API

No API change. What a user sees:

$ datumctl alb hostname add s3 '*.s3.example.com'
Hostname "*.s3.example.com" attached on "s3".

$ datumctl alb describe s3
...
Custom hostnames:
  *.s3.example.com  available=True  dns=False  cert=False
DNS records to publish:
  NAME                             TYPE    CONTENT                            PURPOSE
  *.s3.example.com                 CNAME   ruth-fourth-hrkgk.datumproxy.net   Routing
  _acme-challenge.s3.example.com   CNAME   k3f9q2x7.acme-dns.example.net      Certificate
DNS not delegated: Datum DNS does not serve *.s3.example.com yet. Publish the certificate record _acme-challenge.s3.example.com at the DNS provider that does serve it, so the certificate issues before traffic moves.

A wildcard the platform refused shows the reason beneath it, and the ownership record it needs:

Custom hostnames:
  *.s3.example.com  available=—  dns=—  cert=False
    The wildcard "*.s3.example.com" needs DNS proof that you control s3.example.com or a parent domain. ...
DNS records to publish:
  NAME                                   TYPE    CONTENT                                PURPOSE
  *.s3.example.com                       CNAME   ruth-fourth-hrkgk.datumproxy.net       Routing
  datum-custom-hostname.s3.example.com   TXT     7c1e0d52-3b8f-4a51-a0f6-2f4b6c9d8e11   Ownership

The plugin reads the hostname status list and nothing else, so it never depends on how certificates are named or stored.

Record state	Shown as
Missing, published by the user	a row under "DNS records to publish", each record once
Missing, published by the platform	a "Waiting on Datum DNS" line
Present	not shown

Local validation errors users hit:

Input	Result
'*.s3.example.com'	sent to the platform
'*.*.example.com' or 'foo.*.example.com'	refused locally as not a valid hostname
'*.datumproxy.net'	sent, and refused by the platform

The plugin docs gain a short wildcards section.

Test plan

• Unit tests list missing user records once each, keep platform records apart, and point the hint at the certificate record
• hostname add accepts a single-label wildcard and refuses a multi-label one
• Build, vet, lint and the full suite pass locally and in CI
• Against staging, describe on a load balancer with a wildcard prints the certificate CNAME

Related to datum-cloud/enhancements#913