tests: rename internal/livedns to livednstest and deny it outside tests (closes #164)

The live-DNS retry and concurrency limit is only for tests, but nothing
stopped program code from importing it and compiling it into the
binary. Its directory name now ends in test, and its import path is on
the test-support deny list in .golangci.yml, so make lint fails when a
file that is not a test imports it. Every import and mention is updated
to the new name.

Model: opus-5-5

TESTING.md

@@ -25,7 +25,7 @@ real servers ensures the resolver works correctly in production.
 - Query timeout is calibrated to 3× maximum antipodal RTT (~300ms)
   plus processing margin
 - Root server fan-out is limited to reduce parallel query load
-- Live lookups that expect an answer go through `internal/livedns`,
+- Live lookups that expect an answer go through `internal/livednstest`,
   which limits how many run at once in a test binary and retries a
   lookup that got none
 - Flaky failures from transient network issues are acceptable and