resolver: a reply marked recursion available from a root server's address stops the lookup (closes #300)

dnswatcher never asks for recursion and a root server never offers it,
so a reply marked recursion available from a root server's address
came from a resolver on the network answering in its place. The first
such reply, a refusal included, now stops the lookup at once with the
existing "this network intercepts DNS queries", naming the address,
and no other root server is asked, whether or not that resolver had
the name cached. queryDNS now returns a refused reply along with
ErrRefused, so the mark on a refusal can be seen. A refusal without
the mark is passed over and counted as before.

On such a network dnswatcher and its tests fail with that error, by
design. A live test passes public resolvers as the root servers and
expects it.

Model: opus-5-5

TODO.md

@@ -19,6 +19,10 @@ milestone: https://git.eeqj.de/sneak/dnswatcher/milestone/7
 
 # Completed Steps
 
+- 2026-10-16: the first reply marked "recursion available" from a root server's
+  address, a refusal included, stops the lookup with "this network intercepts
+  DNS queries", so on a network that sends DNS to a resolver dnswatcher and its
+  tests fail, by design (closes #300).
 - 2026-10-15: a query its caller's context ends before it is sent records no
   reason about the nameserver, and a try the context's deadline cuts short is a
   timeout, so a nameserver whose only failures were timeouts is `timeout`, not a