resolver: a reply marked recursion available from a root server's address stops the lookup (closes #300)

dnswatcher never asks for recursion and a root server never offers it,
so a reply marked recursion available from a root server's address
came from a resolver on the network answering in its place. The first
such reply now stops the lookup at once with the existing "this network
intercepts DNS queries", naming the address, and no other root server
is asked, whether or not that resolver had the name cached. Before, a
cached name was checked against the resolver's second-hand answer.

On such a network dnswatcher and its tests fail with that error, by
design; nothing works around the interception. A live test passes
public resolvers as the root servers and expects the error.

Model: opus-5-5

internal/resolver/iterative.go

@@ -287,7 +287,11 @@ func shuffled(
 // order until one gives a usable reply. A server that times out, refuses
 // or gives a reply that is not usable is passed over for the next. When
 // every server refused, the error says so, and when they are the root
-// servers it is ErrIntercepted.
+// servers it is ErrIntercepted. When they are the root servers, the
+// first reply marked recursion available also ends the lookup with
+// ErrIntercepted, naming the address it came from, and no other root
+// server is asked: root servers offer no recursion, so that reply came
+// from something on the network answering in their place.
 func (r *Resolver) queryServers(
 	ctx context.Context,
 	servers []string,
@@ -305,6 +309,14 @@ func (r *Resolver) queryServers(
 		}
 
 		resp, err := r.queryDNS(ctx, ip, name, qtype)
+		if err == nil && zone == "." && resp.RecursionAvailable {
+			return nil, fmt.Errorf(
+				"query %s @%s: reply marked recursion available, "+
+					"so not from a root server: %w",
+				name, ip, ErrIntercepted,
+			)
+		}
+
 		if err == nil && !usableReply(resp, zone, name) {
 			err = fmt.Errorf(
 				"query %s @%s: %w", name, ip, ErrUnusableReply,