Add strict read-only Dynu DNS inventory integration

scripts/dynu/build_dns_inventory.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# This integration is intentionally read-only.
+# No Dynu mutations are permitted in this repo at this stage.
+
+if [[ "${DYNU_READ_ONLY:-}" != "true" ]]; then
+  echo "Refusing to run: DYNU_READ_ONLY must be exactly 'true'." >&2
+  exit 2
+fi
+
+python3 scripts/dynu/fetch_dynu_dns.py
+python3 scripts/dynu/correlate_dynu_with_traefik.py