resolver: error from ResolveIPAddresses when no nameserver answered (closes #190)

ResolveIPAddresses now returns an error, not no addresses, when no
nameserver of the name's zone answered. A nameserver with status
timeout or error is not an answer; one answer, even NXDOMAIN, is
enough for an empty result without an error.

When every server of a zone fails, FindAuthoritativeNameservers moves
on to the parent name, whose servers only refer the query onward. Such
a referral now has status error, so it is no answer either, and a
hostname's saved records show it as error. The only caller, the
nameserver address lookup, already keeps the previous addresses on an
error; its comment no longer says the resolver hides this case.

Model: opus-5-5

internal/watcher/watcher.go

@@ -321,10 +321,9 @@ func (w *Watcher) detectNSChanges(
 }
 
 // resolveNameserverAddresses returns the sorted addresses each
-// nameserver's name resolves to. A nameserver whose lookup fails or
-// finds no address keeps its addresses from prev: the resolver finds no
-// address, without an error, when every server it asks times out, and
-// that is not an address change.
+// nameserver's name resolves to. A nameserver whose lookup fails, as it
+// does when no nameserver of the name's zone answers, or finds no
+// address keeps its addresses from prev and is not an address change.
 func (w *Watcher) resolveNameserverAddresses(
 	ctx context.Context,
 	nameservers []string,