scripts: sanity/dns/wallet-cli helpers; ops cleanup

scripts/taler-dns/README.md

@@ -0,0 +1,48 @@
+# Container DNS pins (hacktivism.ch)
+
+Pasta networking often has **no usable DNS**. Wirewatch needs:
+
+```text
+https://bank.hacktivism.ch/accounts/exchange/taler-wire-gateway/
+```
+
+## Bake into images (preferred)
+
+On koopa:
+
+```bash
+# copy bake assets, then:
+SRC_DIR=/tmp/taler-dns-bake ./bake-hosts-into-images.sh
+```
+
+This:
+
+1. Installs `/usr/local/bin/pin-hacktivism-hosts` **inside** each container  
+2. Hooks `start_base_services_for_taler*.sh` (bank + merchant)  
+3. Enables systemd `pin-hacktivism-hosts.service` (exchange, before wirewatch)  
+4. **Commits** images:
+   - `localhost/taler-hacktivism-banking:live` (+ `:hosts-pinned`)
+   - `localhost/taler-hacktivism-live:landing` (+ `:hosts-pinned`)
+   - `localhost/taler-hacktivism-exchange-ansible:landing` (+ `:hosts-pinned`)
+
+Pin IP default: `212.51.151.254` (`PIN_IP=` to override).
+
+## One-shot without bake
+
+```bash
+./pin-container-hosts.sh          # apply now
+./pin-container-hosts.sh --check  # report resolve + /config
+```
+
+## After recreate
+
+If you start from an **old** image without the bake, run `pin-container-hosts.sh` once.  
+If you use `:hosts-pinned` / updated `:live`/`:landing` images, start_base / systemd re-pin on boot.
+
+Optional podman flags when recreating (extra safety):
+
+```bash
+--add-host=bank.hacktivism.ch:212.51.151.254 \
+--add-host=exchange.hacktivism.ch:212.51.151.254 \
+--add-host=taler.hacktivism.ch:212.51.151.254
+```