Delegate environment subdomains to separate Route 53 hosted zones with Terraform, scoped permissions, and DNS verification checks.