secure-ntp: fix NTS defects surfaced by the F-03 bench

NTS proven end-to-end on comet-beacon-54 (chronyc authdata cookies > 0); these
close the gaps the bench found so a clean build/serving run reaches that state
without manual patching:

- dispatcher (10-chrony-dhcp-ntp): fall back to resolv.conf search/domain when NM
  doesn't export DHCP4_DOMAIN_NAME on the firing event, so the NTS source is
  written reliably at boot (tonight it needed a manual dispatcher run).
- STIG vs secure_ntp (P2, security): STIG's chronyd_specify_remote_server re-injects
  an UNAUTHENTICATED 'server 0.us.pool.ntp.mil maxpoll 16' AFTER the secure_ntp
  chrony step commented servers out -> a silent fallback that defeats NTS's
  DoS-only guarantee (host not fail-closed). Unselect chronyd_specify_remote_server
  + chronyd_or_ntpd_set_maxpoll in diskless-tailoring.xml, and re-strip any
  server/pool in 2c-STIG-postfix when secure_ntp=true. Documented: stig-deviations #17.
- nts-cert.sh (P3): the container's chrony user (non-root) can't read a 0640
  host-owned key -> NTS-KE TLS aborts ('non-properly terminated'). chown the key to
  the ntp container's chrony uid + keep 0640 (0644 works but chrony warns
  world-readable); 0644 fallback if the uid can't be found.

Bench-verified 2026-07-11; docs updated in docs/ssh-host-certificate-design.md's
sibling secure-ntp-design.md flow. F-03/P-18 stays open until a clean build shows
chrony.conf has no plain server and authdata cookies>0 as the only source.

diskless.pkr.hcl

@@ -1085,6 +1085,15 @@ build {
       "    echo '==> fapolicyd: watch_fs now includes overlay (guards the volatile-overlay root)'",
       "  fi",
       "fi",
+      # secure_ntp fail-closed: STIG's chronyd_specify_remote_server remediation
+      # re-adds an UNAUTHENTICATED `server <pool> maxpoll 16` to chrony.conf AFTER
+      # the secure_ntp chrony step commented the baked servers out (2c runs later).
+      # That plain server is a silent fallback that defeats NTS's DoS-only guarantee
+      # (a DNS/NTP spoofer could shift the clock through it — the F-03 risk). When
+      # secure_ntp=true, re-strip any server/pool so ONLY the NTS sourcedir +
+      # ntstrustedcerts remain. The rules are also unselected in the tailoring; this
+      # is belt-and-suspenders. Bench 2026-07-11; docs/stig-deviations.md #17.
+      "if [ \"${var.secure_ntp}\" = \"true\" ] && [ -f /etc/chrony.conf ]; then echo '==> secure_ntp: re-stripping STIG-injected plain NTP servers from chrony.conf (fail-closed: NTS only)'; sed -i -E 's/^[[:space:]]*(pool|server)[[:space:]]/#&/' /etc/chrony.conf; fi",
     ]
   }