refactor: Stage 6: Adopt SupportedTypes across providers

[TomOnTime]

This PR converts all the remaining providers to use SupportedTypes instead of capabilities.CanUseTYPENAME. Old code (validate and the generators) are converted to use new data structures.

The default for a capability is now Cannot(). This makes nearly every provider's doc update. That's intentional. All the "Unknowns" look bad, because they're usually "Cannot". Now if something is truly Unimplemented, we have a more visible place to list that.

Details...

Every built-in provider now declares its managed record types in Definition.SupportedTypes. Validation rejects unsupported records before they reach provider APIs, including basic types that previously passed implicitly and proprietary pseudo-types sent to an unrelated provider.

This is Stage 6, based on Stage 5 (#4967). Retarget after that PR merges.

Changes

• Rename the fixed eight-type selector from Default to Basic8 in declarations, resolution, tests, and documentation. Membership stays A, AAAA, CAA, CNAME, MX, NS, SRV, TXT; the old selector name is rejected.
• Migrate all 75 definitions: 69 DNS providers have exhaustive declarations and six registrar-only definitions declare an empty list. Move operational capabilities to named fields; retain useful record and interface annotations in Features.
• Remove CanOnlyDiff1Features, the custom-record registration/lookup APIs and registry, and the obsolete metadata marker/type-rewrite path. The parser catalog recognizes types; SupportedTypes controls provider compatibility. privatetypes.Register remains.
• Preserve shared URL/URL301 support for Namecheap and Porkbun, Cloudflare's worker/redirect types, and other provider pseudo-types. Use the catalog spelling NETLIFYV6.
• Treat IMPORT_TRANSFORM as a deferred configuration command, outside the provider record catalog and SupportedTypes. It works for every provider. Normalization consumes it before provider auditing and checks the copied records against each provider's declaration. The eight-type Basic8 stays unchanged.
• Refresh generated capability documentation and minimally update the provider-writing guide. JavaScript snapshots change only by removing obsolete metadata.

Support review

Existing advertised advanced record support and annotations are preserved. Unspecified CAA/SRV flags are not promoted to support through Basic8. The following exceptions reflect existing auditors or read/write paths:

Providers	Types now explicitly rejected	Existing limitation
ADGUARDHOME, FORTIGATE, NETBIRD	MX, NS, TXT	Auditors restrict support to their implemented type lists.
OPENWRT	NS, TXT	Auditor supports A, AAAA, CNAME, MX, SRV.
UNIFI	NS	Auditor and converter exclude NS.
AZURE_PRIVATE_DNS	NS	Native record conversion excludes NS.
EXOSCALE, NETCUP	NS	Desired-state processing discards all NS records.
INFOBLOX	NS	Managed record types exclude NS; its representation requires unsupported address data.
MITTWALD, WEBSUPPORT	NS	Existing auditing rejects NS management.
OPENPROVIDER	NS	Child NS is rejected; provider-managed apex NS is filtered.

These NS declarations describe child delegations; injected provider-owned apex nameservers are separate. DNSimple retains child NS support.

General DS support now implies child support for migrated providers, correcting Hetzner's contradictory child-only flag. NONE no longer inherits CAA/SRV support. Exhaustive declarations turn previously unspecified record capabilities into Cannot, accounting for most generated documentation changes.

The project plan records a separate future concurrency change: default concurrency on, with ConcurBroken: true only for providers that cannot run concurrently. This PR preserves current concurrency behavior.

Validation

• go test ./... passes across 116 package results.
• bin/generate-all.sh passes, including generation, module tidy, go fix, golangci-lint (0 issues), and staticcheck.
• New tests cover declared baseline records through every DNS provider's auditor, imports through all 69 DNS providers and providers with empty declarations, auditing only copied records, explicit exclusions, shared/proprietary pseudo-types, aliases, and recognition without a resolved provider. Existing child-DS, transformation, BIND round-trip, and JavaScript compatibility tests pass.
• Compared before/after capability inventories for lost support and annotations; verified driver edits are confined to registration. git diff --check passes.
• No live provider integration profile was selected. Provider API behavior and the broad JavaScript documentation/output conversion remain unchanged.