docs(gateway): say why the e2e DNS wait is non-zero

`max_dns_wait` was raised from 0 to 5 with nothing saying so, in a suite where
everything else carries its reasoning. It is load-bearing: it is certbot's
pre-order self-check budget, and at 0 the poll loop exits before its first
lookup, so the order goes out assuming the mock DNS API has already served the
record. Harmless while Pebble was not validating challenges; a race now that it
is.

Author: kvinwang

dstack/gateway/test-run/e2e/test.sh

@@ -576,7 +576,17 @@ setup_certbot_config() {
         return 1
     fi
 
-    # Create DNS credential
+    # Create DNS credential.
+    #
+    # `max_dns_wait` is non-zero on purpose. It is certbot's pre-order
+    # self-check budget: it polls the challenge zone's authoritative
+    # nameservers for the TXT record before asking the CA to validate, and logs
+    # which record it could not see. At 0 the poll loop exits before its first
+    # lookup (see `dns_poll_sleep`), so the order goes out on the assumption
+    # that the mock DNS API has already served the record -- harmless while
+    # Pebble was not validating challenges, a race now that it is. 5s is ample
+    # against a mock on the same bridge and sits well inside the clamp in
+    # `advisory_dns_wait`.
     log_info "Creating DNS credential..."
     if ! curl -sf -X POST "${GATEWAY_ADMIN}/prpc/Admin.CreateDnsCredential" \
         -H "${ADMIN_AUTH_HEADER}" \