[grade=C urn:ump:bayk3f2ibc3nffwv7wiprdts2xegcp2pac525zwabp7dst37ecbq] docs(DC-171): qualify dig version claim per deploy judge r3 blocker

rfc2136.js comment no longer asserts unverified 9.11-9.16 behavior —
states only the documented [name] [type] contract, live-verified against
BIND 9.18.50. Evidence file gains the full production gate record
(rollback two-ops, bundle IDs, test-log paths, all three judge grades).

dashcaddy-api/src/dns/dns-providers/rfc2136.js

@@ -338,8 +338,10 @@ class RFC2136Provider extends BaseDNSProvider {
     const fqdnZone = this._ensureFqdn(effectiveZone);
 
     // dig positional contract is `dig [@server] [name] [type]` — zone name
-    // FIRST, then the AXFR request type (BIND 9.18 happens to accept either
-    // order, but 9.11-9.16 on older distros follow the documented order).
+    // FIRST, then the AXFR request type. This is the documented order
+    // (verified live against BIND 9.18.50); no claim is made here about
+    // other dig versions' leniency or strictness — see
+    // RELEASE-EVIDENCE-internal.md, DC-171 section.
     const args = [
       `@${this.server}`,
       '-p', String(this.port),