DNS migration in AD install

We have an existing Win 2003 DNS Server in an NT4 domain that serves
our internal network. (External DNS is handled at our ISP and we do not
transfer to them) The forward lookup zone is let's say "foobar.net"
(hosts are listed as hostname.foobar.net).

We are in the process of setting up an AD install, and because the
production domain's admin password cannot be changed due to production
job requirements, the plan is to install a new root domain called
"foobar.net", upgrade the NT4 Production domain in place and make it a
child domain of the root, "production.foobar.net"

As much as possible, users and machines will be moved to the root
domain with only those resources which cannot be changed staying in the
old Production domain.

My questions are these:
1) Can we use the existing 2003 DNS server (a member of the production
domain) as the DNS primary in the new forest (since the lookup zone and
the AD root domain will have the same name) or is the primary DNS
server required to be a member server in the root domain, with the old
DNS server going from primary to secondary?

2) Once we integrate the production domain into AD, does that mean all
the old lookup names (which might be hardcoded into production jobs)
will be invalid? (i.e. a lookup for data.foobar.net, a member of the
Production domain, would fail because its DNS name would become
data.production.foobar.net and not found by production jobs in the new
DNS structure)

3) Alternatively, can lookup zones be separated from AD domain names?
In other words, can the lookup zone "foobar.net" hosted in the root
domain's DNS database hold references to machines that are
adminsitratively in the child domain simply as foobar.net, or do the
DNS entries have to conform to AD naming conventions, and end in
production.foobar.net?

I've been testing my plan in the lab and got to the part of AD install
where the DNS Diagnostic failed because the old DNS server (in the lab)
would not accept dynamic updates. I'm not sure whether it would be
better to go ahead and let the new AD root DC handle DNS and then go
back and make the existing DNS secorndary, or use the existing lab DNS
server and manually insert the SRV records etc. Which is easier/better?