test: make live DNS tests robust instead of gated (closes #93)

The resolver's live-DNS tests failed nondeterministically, a different
subset each run. Three structural causes, all test-side:

- Burst fan-out. Every test in the package is parallel and the build
  hosts have many cores, so all ~35 iterative resolutions started at
  the same instant and, because queryServers walks rootServerList() in
  fixed order, hit the same root server within milliseconds. Root
  servers rate-limit that.
- No retry anywhere. One dropped UDP packet in a delegation chain
  failed a test outright.
- Unanimity assertions. TestQueryAllNameservers_AllReturnOK and
  _NXDomainFromAllNS required every one of a domain's nameservers to
  answer, with no tolerance for one being slow.

New internal/resolver/livedns_test.go addresses each: a package-wide
gate bounds how many live resolutions are in flight at once, every
live operation gets three attempts with exponential backoff and its
own deadline, and multi-nameserver assertions now need a strict
majority rather than unanimity. The retry predicate is deliberately
transport-level -- "did a nameserver answer at all" -- never the
assertion under test, so a resolver that answers incorrectly still
fails on the first attempt. A nameserver that stays silent is
tolerated; one that answers wrongly is not.

livedns_harness_test.go tests that machinery directly: quorum
arithmetic, status counting, the gate's concurrency bound, per-attempt
deadlines, and recovery from a transient failure. It touches no DNS.

Nothing is mocked, faked, stubbed, recorded, skipped or build-tagged,
and production resolver behaviour is unchanged.

Test caps move to the new org-wide values ruled at prompts issue 41:
60s hard cap, 20s target, 90s -timeout backstop. REPO_POLICIES.md is
re-vendored byte-identical from sneak/prompts rather than hand-edited,
which also picks up the golangci-lint paragraph this copy had drifted
behind on. TESTING.md's stale 30-second target follows to 60.

#93

TODO.md

@@ -25,6 +25,16 @@ confirm make check still passes.
 
 # Completed Steps
 
+- 2026-08-10: live-DNS test flakiness addressed by robustness rather
+  than gating, per the owner's ruling on #93: new
+  `internal/resolver/livedns_test.go` adds a package-wide concurrency
+  gate (so parallel tests stop bursting at the first root server),
+  retry with exponential backoff on transport failures only, and
+  quorum instead of unanimity for multi-nameserver assertions. The
+  `make test` cap moved to the new org-wide 60s hard cap / 20s target
+  with a 90s `-timeout` backstop; `REPO_POLICIES.md` re-vendored
+  byte-identical from `sneak/prompts`. No mocks, no `-short`, no build
+  tags, no skips, and no change to production resolver behaviour
 - 2026-08-10: all linting moved into Docker: new root `Dockerfile.lint`
   on the digest-pinned `golangci/golangci-lint:v2.12.2` image,
   `script/lint` reduced to a thin wrapper that builds it with