1. Expose the full DNS record set (incl. the _railway-verify TXT) on the CustomDomain GraphQL type.

When I create a custom domain via customDomainCreate, the dashboard shows a _railway-verify. TXT record (value railway-verify=) required for certificate issuance, plus the CNAME target. Via the GraphQL API I can only read status { verified verificationDnsHost verificationToken }; querying a dnsRecords field returns a 400 (field not in schema). The TXT value appears to be dashboard-only. Please expose the complete required-DNS-record set (CNAME target + the _railway-verify TXT host and value) on the CustomDomain type so domain setup can be fully automated against a DNS provider's API. If verificationDnsHost/verificationToken are meant to carry this, they're returning null for our domains — please confirm the correct fields.

1. An API to wire GitHub push-to-deploy for a newly-connected private repo.

After serviceConnect against a brand-new private GitHub repo, the service's Settings → Source → "Branch connected to production" shows "GitHub Repo not found" and push-to-deploy never wires. The Railway GitHub App appears to lack access to the new repo, and there's no API to grant it. The only working fix is a manual dashboard Disconnect → re-select the repo through the GitHub-App picker. Please provide an API to either (a) list/extend the Railway GitHub App's repo access, or (b) wire branch-tracking for an already-connected repo, so push-to-deploy can be established programmatically.

1. (Related) A way to set a service's repo source via API without triggering an auto-deploy.

serviceConnect immediately auto-deploys, which races our explicit serviceInstanceDeploy (we see up to 4 concurrent builds). An option to connect-without-deploy (or a documented "exactly one deploy" path) would let us control deploy timing.