test(public_dns): Molecule scenario (apply disabled, no live API)

Converge runs in CI; the no-op apply=false scenario adds no local signal over
the pytest, and the test image is on an unreachable registry.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

roles/public_dns/molecule/default/converge.yml

@@ -2,6 +2,13 @@
 - name: Converge
   hosts: all
   gather_facts: true
-
+  vars:
+    public_dns__apply: false          # never call the Gandi API from a container
+    public_dns__domain: example.test
+    public_dns__records:
+      - {record: "@", type: MX, values: ["0 ."], ttl: 3600}
+      - {record: "@", type: TXT, values: ['"v=spf1 -all"'], ttl: 3600}
+    public_dns__absent:
+      - {record: www, type: CNAME}
   roles:
     - role: public_dns

roles/public_dns/molecule/default/verify.yml

@@ -1,11 +1,12 @@
 ---
 - name: Verify
   hosts: all
-  gather_facts: true
-
+  gather_facts: false
   tasks:
-    - name: Add verification tasks here
+    - name: Role variables resolved
       ansible.builtin.assert:
-        that: true
-        msg: "Replace this with real assertions"
+        that:
+          - public_dns__domain == "example.test"
+          - public_dns__apply | bool == false
+        msg: "public_dns defaults/vars did not resolve as expected"
       tags: [verify]