feat: wire Domain CR through the CQRS engine

[ntlaletsi70]

Summary

• Domain CR follow-up to Route (feat: wire Route CR through the CQRS engine #121). internal/domains/domain was an empty stub, internal/controller/networks/domain.go's reconciler was a genuine no-op (fetch, return — no finalizer, no engine dispatch, no Runtime field), and internal/cache/domain didn't exist. All three are now wired the same way Route is: finalizer-gated reconciler, Engine.Execute dispatch, DomainDomain handling create/update/delete via DomainService.
• Domain's KnativeProvider needs an ACMEConfig (server, account email, private key secret name) that nothing in this controller previously supplied. Added three flags to cmd/main.go (--acme-server defaults to Let's Encrypt production, --acme-email has no default, --acme-private-key-secret-name defaults to acme-account-key) and split Domain registration out of RegisterControllers into its own RegisterDomain(mgr, rt, acmeConfig), mirroring how RegisterBuild is already split out for its own dependency (a Shipwright client).
• Also fixes a more severe, pre-existing gap this surfaced: neither Knative (serving.knative.dev, networking.internal.knative.dev) nor cert-manager.io schemes were ever registered anywhere in this controller — Route's own KnativeProvider (DomainMapping) would have hit no kind is registered for the type ... in scheme the first time it tried to create one, the same class of bug the missing networksv1alpha1 registration was before it. Added all three to both RegisterSchemes (production) and testsupport.NewScheme (tests).
• Deliberately left DomainCache.PublishStatus unwired — DomainService.Reconcile doesn't return the values it needs (domainReady, certRef, mappingRef), and fabricating them would be worse than leaving the gap for whichever follow-up builds the Route mediator's Domain integration.

Blocked — draft

Needs an environments release containing blanketops/environments#316 (DomainService.Teardown). go.mod stays pinned at the current release (v0.8.0), which doesn't have it yet. Confirmed the exact, isolated failure — everything else in this change compiles and tests cleanly against v0.8.0:

internal/domains/domain/domain.go:165:29: d.domainService.Teardown undefined (type *application.DomainService has no field or method Teardown)

Test plan

• go build ./..., go vet ./..., go test ./... all clean against a local replace pointing at the unreleased environments branch containing #316
• golangci-lint run ./... — 0 issues
• New internal/domains/domain/domain_test.go — GVK, CanCreate/CanUpdate/CanDelete, Handle invalid-object/resolution-failure/create-succeeds (asserts exactly one ClusterDomainClaim applied)/delete-removes-what-create-applied
• Un-draft once environments cuts a release including #316, bump go.mod, confirm real build/test