docs: health check wording follows the code (rework for #302)

The README, the comments and TODO.md say the health check gives error
only when every lookup in a round failed because no root server gave a
usable reply, and the README drops the claim that the other failures
are reported as notifications.

Model: opus-5-5

internal/watcher/dnsunreachable_test.go

@@ -15,9 +15,10 @@ import (
 // four operators mark their replies recursion available, as on a network
 // that intercepts DNS queries; one that gives no reply is passed over
 // for the next, and if none replies, no root server answered. Either
-// way no lookup got a reply from a root server, so the round could not
-// reach the DNS. TestFirstRunBaseline and TestDomainThatDoesNotExist
-// check rounds in which the root servers answered.
+// way every lookup failed because no root server gave a usable reply,
+// so the round could not reach the DNS. TestFirstRunBaseline and
+// TestDomainThatDoesNotExist check rounds in which the root servers
+// gave a usable reply.
 func TestDNSUnreachableWhenNoRootServerReplies(t *testing.T) {
 	t.Parallel()
 
@@ -58,7 +59,7 @@ func TestDNSUnreachableWhenNoRootServerReplies(t *testing.T) {
 
 			if !w.DNSUnreachable() {
 				t.Error("DNSUnreachable is false after a round in " +
-					"which no lookup got a reply from a root server")
+					"which no root server gave a usable reply")
 			}
 		})
 	}