LPX-695: destroy:app — never tear down the hosted zone, withdraw only its records

[stevethomas]

Hey, I made a thing! 🥳

Follow-up to the merged #158. (LPX-695)

What problems are you solving?

• destroy:app could delete the whole Route 53 hosted zone (when it was reduced to NS/SOA). That's the wrong call: a hosted zone is domain-level infrastructure — the registrar's NS delegation points at it, and the domain's email/verification DNS and any sibling environment's records all live in it — so it outlives any single app. App teardown should withdraw only the records YOLO inserted and leave the zone standing.
• Worth noting: YOLO does create the zone on first sync (SyncHostedZoneStep), but create ≠ own-to-destroy here — same stance as the BYO data bucket.

Is there anything the reviewer needs to know to deploy this?

• No deploy/runtime change. Only destroy:app's Route 53 teardown behaviour changes (and destroy:app is admin-tier, human-gated, not in any automated path).
• HostedZone no longer implements Deletable. New removeAppRecords() deletes only this app's A/AAAA records (canonical host + apex/www sibling); the zone is never deleted. TeardownHostedZoneStep withdraws those records — no ownership gate (it only ever touches this app's own record names, so the shared-zone hazard is gone).
• Arch invariant updated: HostedZone joins S3Bucket as a deliberate non-Deletable App-scoped resource, asserted directly so the exclusion can't rot.
• Supersedes the two Route 53 review blockers from LPX-695: yolo destroy:app — app teardown (reverse of sync:app) #158 (fail-open ownership read; wiping all DNS records incl. email) — both disappear when nothing deletes the zone.
• Green: full suite 1351; Pint, Rector, PHPStan, Coverage all pass in CI.

🤖 Generated with Claude Code