Fix EnsureRecord to check all existing records before updating

When multiple A records exist for a service (e.g., LAN and Tailscale
IPs), check all of them for the correct value before attempting an
update. Previously only checked the first record, which could trigger
a 409 conflict if another record already had the target value.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/agent/dns.go

@@ -76,8 +76,8 @@ func (d *DNSRegistrar) EnsureRecord(ctx context.Context, serviceName string) err
 		return fmt.Errorf("list DNS records: %w", err)
 	}
 
-	if len(existing) > 0 {
-		r := existing[0]
+	// Check if any existing record already has the correct value.
+	for _, r := range existing {
 		if r.Value == d.nodeAddr {
 			d.logger.Debug("DNS record exists, skipping",
 				"service", serviceName,
@@ -86,13 +86,16 @@ func (d *DNSRegistrar) EnsureRecord(ctx context.Context, serviceName string) err
 			)
 			return nil
 		}
-		// Wrong value — update it.
+	}
+
+	// No record with the correct value — update the first one if it exists.
+	if len(existing) > 0 {
 		d.logger.Info("updating DNS record",
 			"service", serviceName,
-			"old_value", r.Value,
+			"old_value", existing[0].Value,
 			"new_value", d.nodeAddr,
 		)
-		return d.updateRecord(ctx, r.ID, serviceName)
+		return d.updateRecord(ctx, existing[0].ID, serviceName)
 	}
 
 	// No existing record — create one.