docs: TESTING.md constraints match the resolver and the test-time policy (closes #289)

The Constraints list named a query timeout calibrated to round-trip time and a
limited root-server fan-out; the resolver has neither. It now gives the
2-second timeout and the second try over UDP, says a zone's servers are asked
one at a time in a random order, and gives the 60-second cap and 20-second
target for make test from REPO_POLICIES.md.

Model: opus-5-5

TODO.md

@@ -19,6 +19,10 @@ milestone: https://git.eeqj.de/sneak/dnswatcher/milestone/7
 
 # Completed Steps
 
+- 2026-10-15: `TESTING.md` Constraints give the resolver's 2-second query
+  timeout and second try, say a zone's servers are asked one at a time in a
+  random order, and give the 60-second cap and 20-second target for `make test`
+  (closes #289).
 - 2026-10-13: a hostname or a domain whose zone's nameservers all stop answering
   gets an NS Failure for each, then an NS Recovery (closes #284).
 - 2026-10-13: an IPv6 address is written in brackets before its port, as in