Azure external-dns deploys unconditionally; external_dns_enabled flag only honored on AWS

Summary

On Azure (AKS), external-dns is deployed unconditionally by the helm step. The external_dns_enabled configuration flag is only consulted on the AWS code paths; the Azure path (lib/steps/helm_azure.go) installs external-dns with no guard.

Impact

• Setting external_dns_enabled: false has no effect on Azure — external-dns (its namespace, the azure-config-file secret, managed identity, DNS-zone role assignment, and HelmChart) is still created.
• Surfaced during attestation review: the generated doc reported "External DNS disabled" while the resources were present. The attestation prose has since been corrected to reflect Azure's actual behavior, but the underlying deploy behavior is unchanged.

Suggested fix

Either honor external_dns_enabled on the Azure path (guard the external-dns install in helm_azure.go), or treat the flag as AWS-only by design and document that.

References

• lib/steps/helm_azure.go — Azure external-dns deployed unconditionally
• lib/steps/clusters_aws.go, lib/steps/persistent_aws.go — where the flag is honored (AWS)

Start in lib/steps/helm_azure.go and compare its external-dns handling with the flag checks in lib/steps/clusters_aws.go and lib/steps/persistent_aws.go. Confirm the intended Azure behavior before changing it; done means Azure no longer contradicts the documented meaning of external_dns_enabled, including the listed external-dns resources.