Fix DDNS/failover Cloudflare zone name and add restricted PSS securityContext

- ZONE_NAME was "kube.huskypup.net" in both the home-ip-ddns CronJob and
  the VPS failover watcher - that's a record, not a Cloudflare zone (the
  actual zone is the parent "huskypup.net"). Caused home-ip-ddns to fail
  every run (zone lookup returned zero results, curl -f exit 22) -
  confirmed live and fixed.
- Added seccompProfile/non-root/dropped-capabilities securityContext to
  the three CronJobs added this session that were missing it (flagged by
  the cluster's "restricted" PodSecurity admission). Repointed the raft
  snapshot job's mc binary install from /usr/local/bin to /tmp so it
  still works running as non-root.

infrastructure/cert-manager/manifests/home-ip-ddns-cronjob.yaml

@@ -17,7 +17,7 @@ data:
     #!/bin/sh
     set -eu
 
-    ZONE_NAME="kube.huskypup.net"
+    ZONE_NAME="huskypup.net"  # Cloudflare zone is the parent domain - kube.huskypup.net is just a record within it, not its own zone
     RECORD_NAME="home.kube.huskypup.net"
     TOKEN="$(cat /etc/cf/cloudflare-token)"
 
@@ -75,6 +75,8 @@ spec:
           securityContext:
             runAsNonRoot: true
             runAsUser: 65534
+            seccompProfile:
+              type: RuntimeDefault
           containers:
             - name: ddns-update
               image: alpine/k8s:1.32.13  # already has curl + jq (see MEMORY.md kubectl image note)