Fixture for issue #24: the occluded-records policy check.

occluded.zone is deliberately unsigned: occlusion is a zone-structure
property, independent of DNSSEC.  It exercises every classification the
check makes:

  ns1.del1      A    glue referenced by its own delegation      -> exempt
  ns2.far       A    glue referenced by the apex NS RR set      -> exempt
  ns2.del1      A    sibling glue (referenced only by del3)     -> reported
                     under the strict default, exempt with
                     -p no-strict-glue
  deep.del2     NS   NS RR set below a cut                      -> reported
  ns.deep.del2  A    referenced only from that occluded NS set  -> reported
                     (occluded owners cannot launder glue)
  junk.del2     A    referenced by nothing                      -> reported
  note.del2     TXT  non-address type below a cut               -> reported

Every delegation carries two NS records so that -p all stays free of
single-ns noise.  No regeneration needed; the zone is committed as-is.
