Add the ZS nano but keep it exactly as written. You want the isolation and any additions will add fragility. The entire point of ZS is resilience.

Then make your Mac a full ZeroSentinel Core. So WireGuard (optional), canary, DNS filter, and fall back redundant unbound and chrony.

Using Pi hole instead AdGuard means you will lose some convenience and scalability but they are doing the same function. If you are already comfortable with the UI, managing lists, and have an existing workflow then use it. That matters more than theoretical efficiency.

Happy building!