fix: sync_dns_zone no longer copies an override made by hand

The records netOrk sends include what its poll read off the same
firewall, hand-made host overrides among them. sync_dns_zone deletes only
tagged overrides and then added every record again under the tag, so each
hand-made override ended up on the device twice (NetOrk/netork#1123).

An enabled, untagged override with the same name, type and address in the
zone now stands in for its record. A copy made earlier is tagged, so the
next sync deletes it and does not add it again.

napalm_opnsense/opnsense.py

@@ -2933,8 +2933,17 @@ class OPNsenseDriver(OPNsensePingMixin, FirewallDriver):
         # Re-add all enabled A/AAAA records, one override per logical record.
         # Two rows for the same name is a state netOrk's own database can
         # legitimately be in; the device must still end up with one.
+        # An enabled override made by hand already answers for its record: the
+        # caller's records include what it read off this device, and adding
+        # those again under the tag left each one twice (NetOrk/netork#1123).
         added = 0
-        pushed: set[tuple[str, str, str]] = set()
+        pushed: set[tuple[str, str, str]] = {
+            (entry["hostname"].lower(), entry.get("record_type", "A"), entry["ip"])
+            for entry in existing
+            if entry["domain"].rstrip(".") == zone_clean
+            and not entry["description"].startswith(self._NETORK_TAG)
+            and entry.get("enabled", True)
+        }
         for rec in records:
             if not rec.get("enabled", True):
                 continue