Option to keep default resolv.conf

Background:
  When provisioning box outside of our private networks, such as private
  virtual demo machine in VirtualBox, current chef stomps over proper
  resolv.conf, replaces its nameservers with those that are inaccessible,
  and then hangs itself on the next step trying to resolve some server
  name, thinking how unfair life is.

  Copying back correct resolv.conf helps to unstuck chef, but only for so
  long.

  Consequently, currently that 'some server name' is related to
  circonus/nad install, and it is left in half-completed state, causing
  svc.configd to constantly slurp 27% of CPU. Ugh.

  Problem solved by chef doing nothing to the file if another (flag) file exists
  with '.chefless' suffix added (this pattern can be extended to other
  areas, like authorized_keys file, that suffers from similar problem).
  'touch /etc/resolv.conf.chefless' is all that is required to keep chef
  away from it.

Of course, same problem may be solved the 'proper' way by adding
configuration for array of nameservers, and using dynamic template to
render them, but this solution seems simpler, sufficient, not as
heavy weight, and applicable to other problems.

Another way of skinning this cat is to replace flag file with flag
property in node data or a collection on 'untouchable' file names on
this node.

Your thoughts?