Don't rebuild iptables rulesets immediately for zeroconf.

Previously, if node provisioning failed halfway through, we'd end up
with an iptables ruleset that blocked SSH access.  That's no good for
development.

(Hopefully this won't affect zeroconf startup.)
Extract the CNAME publisher from the ncs_navigator cookbook.

It's really a Zeroconf-related detail.
More Cases recipe work.