Mark the configs that deliberately keep a custom controls config

Mark the configs that deliberately keep a custom controls config

Every remaining deviation from the shared _common/controls.conf.j2
include is intentional; annotate each with a one-line grep-able
comment stating why:

- rndc/ns2 and ns5 test multi-key and read-only channels; ns4 gets a
  runtime-generated multi-key channel appended by setup.sh;
- resolver/ns9 runs an IPv6-only channel, which the IPv4-only shared
  template cannot express;
- shutdown/resolver lives in a non-ns<N> directory, so the template's
  ns.ip variable is not injected there.

Assisted-by: Claude:claude-fable-5