fix(drift): run one reversed octodns-sync per live provider - #5

generate_drift_config() reversed each zone's full targets list into a
single sources list, so a multi-target zone (e.g. hcloud + desec)
populated one octoDNS zone object from every live provider at once.
octoDNS populates with lenient=False, so any record present in more
than one provider raises DuplicateRecordException — and with a
shadow-provider setup every shared record collides, making drift-check
structurally unusable for such repos.

Now:
- live_providers() collects all live providers across zones
  (first-appearance-ordered, deduplicated)
- generate_drift_config() takes a required provider argument, scopes
  the reversed config to zones targeting that provider, and returns
  the reversed zones mapping
- main() runs octodns-sync once per provider with its own temp config,
  fail-fast rc 2 on error, aggregates drift per provider, and reports
  each drifting provider by name; --zone skips providers that do not
  serve that zone

Fixes #4

- A bare `targets:` key loads as None; iterate `or []` like octoDNS's
  own manager instead of crashing with TypeError (P2).
- The --zone provider skip is only decidable when every zone key in the
  provider's reversed config is concrete: a '*'-prefixed key is a
  dynamic zone entry only octoDNS can expand, so with one present the
  run proceeds and octodns-sync applies the zone filter itself (P1 --
  previously --zone on a dynamic-zone config skipped every provider and
  falsely reported "No drift detected").

…check

Second review round on PR #5, all three findings in the per-provider
config generation:

- Zones not targeting the provider are now kept as inert blockers
  (original sources, targets: []) instead of being dropped: octoDNS
  skips them without populating ("no eligible targets"), but the key
  still subtracts from a dynamic ('*') entry's expansion candidates, so
  an explicit zone that deliberately omits a provider no longer gets
  re-included by that provider's wildcard.
- With every zone key present, the --zone provider precheck is
  unnecessary and is removed: the filter is passed straight to
  octodns-sync, whose IdnaDict lookup normalizes case/IDNA (the raw
  dict membership test here did not) and whose manager expands dynamic
  zones before filtering. A provider not serving the zone now resolves
  to its blocker entry and reports no changes.
- manager.plan_outputs is stripped from the generated configs: it
  writes to a fixed filename, so one run per provider would leave only
  the last provider's plan. Drift reads the sync stderr; file plan
  outputs serve no purpose here.