Add CONTEXT.md, consumer README skeleton, and package Examples.

Co-authored-by: Cursor <cursoragent@cursor.com>

CONTEXT.md

@@ -0,0 +1,25 @@
+# go-dns
+
+Shared Go Library for authoritative DNS against BIND-compatible nameservers: full zone transfer (AXFR) and RFC 2136 dynamic UPDATE with caller-supplied TSIG. ExApps and Services import `gitea.neitzel.de/konrad/go-dns`.
+
+## Language
+
+**Session**:
+A `Client` bound to one nameserver address, one zone name, and one TSIG key. AXFR and UPDATE both use that Session; there is no anonymous or unsigned mode in this Library.
+_Avoid_: resolver client, stub, recursive lookup API
+
+**Zone / RRSet / Record**:
+A Zone is the in-memory result of an AXFR (origin, SOA serial, flat record list). An RRSet groups Records that share owner, class, and type. A Record is one resource record with presentation-format rdata.
+_Avoid_: zone file on disk as the Library's primary type, miekg/dns RR as the public model
+
+**UPDATE**:
+An RFC 2136 dynamic DNS change batch (add and/or delete Records) sent through the Session. The Library builds and signs the message; the nameserver applies it.
+_Avoid_: nsupdate script files, unsigned updates
+
+**AXFR**:
+A full zone transfer over TCP for the Session's zone, returning a Zone. Incremental transfer (IXFR) is out of scope.
+_Avoid_: AXFR over UDP, treating AXFR as a recursive query
+
+**TSIG key**:
+Caller-supplied key name, algorithm (e.g. hmac-sha256), and base64 secret used to authenticate AXFR and UPDATE. The Library does not generate keys or write BIND configuration.
+_Avoid_: API token, shared AppAPI secret, auto-provisioned keys