tests: rename internal/livedns to livednstest and deny it outside tests (closes #164)

The live-DNS retry and concurrency limit is only for tests, but nothing
stopped program code from importing it and compiling it into the
binary. Its directory name now ends in test, and its import path is on
the test-support deny list in .golangci.yml, so make lint fails when a
file that is not a test imports it. Every import and mention is updated
to the new name.

Model: opus-5-5

TODO.md

@@ -19,6 +19,9 @@ Rationale, Design, TODO, License, Author) if any are still missing.
 
 # Completed Steps
 
+- 2026-09-29: the live-DNS test package is renamed `internal/livednstest` and
+  added to the `test-support` `deny` list in `.golangci.yml`, so `make lint`
+  fails when program code imports it (closes #164).
 - 2026-09-29: `.golangci.yml` re-fetched unchanged from `sneak/prompts`. It
   replaces the deprecated `gomodguard` with `gomodguard_v2`, so `make lint` no
   longer warns about it, and turns on `depguard` with the org `test-support`
@@ -30,8 +33,8 @@ Rationale, Design, TODO, License, Author) if any are still missing.
   record and nameserver changes by preparing the saved state a check starts
   from; the resolver timeout test queries an address that never answers, and
   `NewFromLoggerWithClient`, used only by its stand-in client, is gone. The
-  live-DNS retry and concurrency limit moved to `internal/livedns`, which both
-  test packages use. `TESTING.md` states the README's rule (closes #159).
+  live-DNS retry and concurrency limit moved to `internal/livednstest`, which
+  both test packages use. `TESTING.md` states the README's rule (closes #159).
 - 2026-09-28: the inconsistency alert is sent once, on the check where two
   nameservers start to disagree or where a nameserver that disagrees first
   appears, instead of on every check while they disagree, and not again after