External DNS server violates rfc8020 by returning NXDOMAIN for the `sys` label

Creating this issue as requested by @hermanol

When a domain (e.g. cloud.example.com) is delegated to a rack, the rack is (ostensibly) authoritative for all labels under that zone. However, queries for the sys label itself (e.g. IN A sys.cloud.example.com) return NXDOMAIN. This violates RFC 8020 -- NXDOMAIN means the name and all names below it authoritatively do not exist. However, there are plenty of names below that label, such as all the silo names. Because recovery.sys.cloud.example.com exists, sys.cloud.example.com must also exist (and is an "empty non-terminal"). Queries for sys. should always return NOERROR with an empty answer section.

Here's an example of the incorrect behavior on Omicron running on my Helios VM at rel/v21/rc1. I can test with a newer version, but I believe this behavior doesn't change.

jreed@jreed-helios:~/omicron$ dig recovery.sys.oxide.test @192.168.1.20

; <<>> DiG 9.18.35 <<>> recovery.sys.oxide.test @192.168.1.20
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34606
;; flags: qr aa rd; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;recovery.sys.oxide.test.       IN      A

;; ANSWER SECTION:
recovery.sys.oxide.test. 0      IN      A       192.168.1.24
recovery.sys.oxide.test. 0      IN      A       192.168.1.22
recovery.sys.oxide.test. 0      IN      A       192.168.1.23

;; Query time: 0 msec
;; SERVER: 192.168.1.20#53(192.168.1.20) (UDP)
;; WHEN: Mon Aug 17 16:28:44 UTC 2026
;; MSG SIZE  rcvd: 112

jreed@jreed-helios:~/omicron$ dig sys.oxide.test @192.168.1.20

; <<>> DiG 9.18.35 <<>> sys.oxide.test @192.168.1.20
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 40736
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;sys.oxide.test.                        IN      A

;; Query time: 0 msec
;; SERVER: 192.168.1.20#53(192.168.1.20) (UDP)
;; WHEN: Mon Aug 17 16:28:46 UTC 2026
;; MSG SIZE  rcvd: 32

Start by reproducing the two dig queries from the issue and locate the external DNS handling for delegated rack zones. Trace why the sys label returns NXDOMAIN despite recovery.sys resolving. Done means sys. returns NOERROR with an empty answer section while descendant names continue to resolve, with coverage for this behavior.