resolver: ask a referral's nameservers that come without addresses (closes #221)

Looking up a nameserver's own address followed only the addresses a
referral gave, so a nameserver whose zone is delegated without them,
such as a.ntpns.org of pool.ntp.org, never resolved. The walk to a
name's nameservers looked addresses up only when a referral gave none,
so when it gave some it asked only those. Both now ask the nameservers
whose addresses the referral gives first and, if none of them gives a
usable reply, look up and ask the others; with no addresses given, all
are looked up, as before. Looking up all of them at once sent too many
queries to the root servers. maxLookupDepth stops lookups two deep, so
delegations that point at each other still end.

Model: opus-5-5

TODO.md

@@ -19,6 +19,8 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 # Completed Steps
 
+- 2026-10-02: nameservers a referral gives no address for are looked up when
+  needed, two deep at most; `pool.ntp.org`'s nameservers resolve (closes #221).
 - 2026-10-02: a resolver test that reads one record type from a nameserver's
   answer asks again when that type is missing from it (closes #218).
 - 2026-10-02: a plain `docker build .` of a clone stamps its tag or short