healthcheck: answer 503 when the last round of DNS checks reached no root server (closes #302)

The health check answered ok while every DNS lookup failed, as on a
network that intercepts DNS queries. A lookup whose root servers give no
usable reply now fails with ErrNoRootServerAnswered. At the end of each
round of DNS checks the watcher records whether every lookup failed with
it or with ErrIntercepted; the health check then gives status error, and
/.well-known/healthcheck and /health answer 503. Until the first round
finishes it stays ok.

The health check now depends on the watcher, so fx builds the watcher
first: its first round starts before the HTTP server listens, and the
server tests' fx graph includes it. NewWithRootServers lets tests start
a resolver's walks at real servers that are not root servers.

Model: opus-5-5

internal/watcher/watcher_test.go

@@ -385,11 +385,16 @@ func TestFirstRunBaseline(t *testing.T) {
 	cfg.Domains = []string{testSmallDomain}
 	cfg.Hostnames = []string{testHost}
 
-	_, deps := runChecks(t, cfg, nil)
+	w, deps := runChecks(t, cfg, nil)
 
 	assertNoNotifications(t, deps)
 	assertStatePopulated(t, deps)
 
+	if w.DNSUnreachable() {
+		t.Error("DNSUnreachable is true after a round whose lookups " +
+			"succeeded")
+	}
+
 	// testHost answers with an address, so the check saves an empty list
 	// of CNAME addresses for it; nil would mean the check did not look
 	// at whether to follow a CNAME.
@@ -551,7 +556,9 @@ func TestNSChangeDetection(t *testing.T) {
 // with nameservers and records saved by an earlier check. The .com
 // servers answer that it does not exist, so it is saved with nxdomain
 // set and no nameservers, an NS Change removes them all, and its saved
-// records are removed rather than asked for at the .com servers.
+// records are removed rather than asked for at the .com servers. The
+// round's only lookup failed, but the root servers and the .com servers
+// answered, so the round reached the DNS.
 func TestDomainThatDoesNotExist(t *testing.T) {
 	t.Parallel()
 
@@ -560,11 +567,12 @@ func TestDomainThatDoesNotExist(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{domain}
 
-	var deps *testDeps
+	var (
+		w    *watcher.Watcher
+		deps *testDeps
+	)
 
 	livednstest.Retry(t, "watcher checks", func(ctx context.Context) error {
-		var w *watcher.Watcher
-
 		w, deps = newTestWatcher(t, cfg)
 
 		deps.state.SetDomainState(domain, &state.DomainState{
@@ -602,6 +610,11 @@ func TestDomainThatDoesNotExist(t *testing.T) {
 		t.Errorf("records saved for %s: %v", domain, hs.RecordsByNameserver)
 	}
 
+	if w.DNSUnreachable() {
+		t.Error("DNSUnreachable is true after a round that reached " +
+			"the .com servers")
+	}
+
 	assertNotified(t, deps, "NS Change: "+domain, "warning")
 
 	// That is the only notification, and it removes both nameservers,