AutoSSL wildcard issuance after the cPanel v106 PowerDNS transition with external DNS

Since cPanel v106 made PowerDNS the default authoritative nameserver (replacing BIND, with zone storage moving to SQLite), I am trying to understand the supported path for AutoSSL wildcard certificates on domains whose DNS is hosted at an external provider rather than on the cPanel server or its DNS cluster.

My understanding is that AutoSSL defaults to Let's Encrypt via HTTP-01, and DNS-01 — required for wildcards — is only automated when cPanel is authoritative or a supported provider plugin (e.g., Cloudflare, Route 53) is in use. With an external provider that has no plugin, the TXT record apparently must be deployed manually or via a custom hook, and the PowerDNS API needed for scripted updates is not exposed by default.

There also seems to be a compatibility boundary: DNSSEC and AutoSSL DNS-01 are documented as working together only when the cPanel server is authoritative, and cluster DNSSEC key rollovers may lag on replicas until the next zone sync.

Assuming cPanel v106–v118 (behavior may differ in later releases and should be verified against current release notes):

• Is there a supported, non-manual way to complete DNS-01 for wildcards when DNS lives at an unsupported external provider?
• Does enabling the PowerDNS API for scripted TXT updates conflict with cPanel's own zone management?
• Are DNSSEC rollovers on a PowerDNS cluster expected to cause transient validation failures, and is that tunable?