watcher: a hostname whose zone's nameservers all stop answering gets NS Failure (closes #284)

When none of the nameservers of a hostname's zone answered, the walk to
them failed and the check was only logged. The walk now returns a
NoAnswerError naming the nameservers of the zone it reached through a
referral when none of them answers. When those are the nameservers the
previous check saved for the name, each is saved as failed with the
reason, so it gets an NS Failure and later an NS Recovery. A domain with
no delegation of its own, whose NS lookup is that same walk, gets the
same. A walk that fails before that zone, as when the host loses its
network, is still only logged.

Model: opus-5-5

README.md

@@ -104,9 +104,11 @@ notification endpoint set, changes show only on the dashboard; see
   NS change notification above. A domain listed in
   `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no record change or inconsistency
   notification. A domain with no delegation of its own has these records asked
-  at the servers of the zone it is in, as a hostname has. A nameserver the
-  domain's records were asked at on the previous check but not on this one gets
-  a hostname's NS change notification (see below), unless it was in the domain's
+  at the servers of the zone it is in, as a hostname has. When none of those
+  servers answers, the lookup of its NS record set fails, and they are saved as
+  failed and notified as a hostname's are (see below). A nameserver the domain's
+  records were asked at on the previous check but not on this one gets a
+  hostname's NS change notification (see below), unless it was in the domain's
   delegation on the previous check, as when that delegation is withdrawn. A
   domain that does not exist has none: they are not asked for, and those saved
   by an earlier check are removed without a notification.
@@ -121,7 +123,13 @@ notification endpoint set, changes show only on the dashboard; see
   trace moves from a name to its parent only when the servers asked answer that
   the name has no delegation of its own, or does not exist. When they do not
   answer, the check fails and the hostname's records from the previous check are
-  kept.
+  kept, unless they are the nameservers the previous check saved for the
+  hostname. Each of those is then saved as failed, with the reason, as a
+  domain's nameservers are when none of them answers, so it gets an NS query
+  failure notification, and an NS recovery notification when it answers again
+  (see below). A trace that gets no answer before it reaches them, as when the
+  host running dnswatcher loses its network, fails the check without a
+  notification.
 - Queries **each** authoritative nameserver independently for **all** record
   types: A, AAAA, CNAME, MX, TXT, SRV, CAA, NS.
 - Each record type is a query of its own. When a nameserver answers some types