Split-horizon DNS across 3 sites over a Tailscale mesh

Three VPC + IDC site pairs, each owning a private Route 53 hosted zone for corp.internal; local Unbound resolvers forward the zone over Tailscale.