Here's what I want to do:

1. Move paws.wmflabs.org from a proxy to a DNS domain
2. Set up an A record for paws.wmflabs.org to point to a floating IP (this floating IP is in the tools project!)
3. Be able to set up *.paws.wmfalbs.org A records in the future.

As far as I can tell, paws.wmflabs.org (the record) can only be in paws.wmflabs.org (the domain). So having the stand-alone record be in a different project from the domain-with-subrecords won't work. That means that #2 is probably impossible to do within tools if we want *.paws.wmflabs.org to be owned by the paws project.

I originally thought you just wanted a proxy paws.wmflabs.org and also subdomains *.paws.wmflabs.org in the same project, which I think is possible.