resolver: error from ResolveIPAddresses when no nameserver answered (closes #190)

ResolveIPAddresses now returns an error, not no addresses, when no
nameserver of the name's zone answered. A nameserver with status
timeout or error is not an answer; one answer, even NXDOMAIN, is
enough for an empty result without an error.

When every server of a zone fails, FindAuthoritativeNameservers moves
on to the parent name, whose servers only refer the query onward. Such
a referral now has status error, so it is no answer either, and a
hostname's saved records show it as error. The only caller, the
nameserver address lookup, already keeps the previous addresses on an
error; its comment no longer says the resolver hides this case.

Model: opus-5-5

TODO.md

@@ -20,6 +20,8 @@ https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 # Completed Steps
 
+- 2026-10-01: `ResolveIPAddresses` returns an error, not no addresses, when no
+  nameserver of the name's zone answered (closes #190).
 - 2026-10-01: `make fmt-check` fails on a file `goimports` would change; both
   format scripts run `goimports` at its pinned commit, not from `PATH` (#119).
 - 2026-10-01: a hostname is queried at the servers of the zone it is in, found