watcher, config: no Record Change or Inconsistency for listed names (closes #255)

DNSWATCHER_SKIP_RECORD_NOTIFICATIONS takes a comma-separated list of
names from DNSWATCHER_TARGETS, read as the targets are (letter case,
trailing dot, repeats). For a listed name no Record Change and no
Inconsistency notification is sent; its records are still checked and
saved, and its other notifications are sent. A listed name that is not
a target stops startup with an error naming it.

The two detections return early for a listed name. Apex domains are
covered too: their own records go through the same detection.

Live DNS cannot be made to disagree on purpose, so the Inconsistency
test feeds records to the change detection directly, as the existing
inconsistency tests do; the live test covers Record Change.

Model: opus-5-5

README.md

@@ -99,10 +99,11 @@ notification endpoint set, changes show only on the dashboard; see
   records, stored per nameserver. Their changes are notified as a hostname's
   are, as a record change, NS query failure, NS recovery, inconsistency or CNAME
   address change, in a message that starts `Domain:` where a hostname's starts
-  `Hostname:`. A domain with no delegation of its own has these records asked at
+  `Hostname:`. A domain listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no
-  the servers of the zone it is in, as a hostname has. A domain that does not
+  record change or inconsistency notification. A domain with no delegation of
-  exist has none: they are not asked for, and those saved by an earlier check
+  its own has these records asked at the servers of the zone it is in, as a
-  are removed without a notification.
+  hostname has. A domain that does not exist has none: they are not asked for,
+  and those saved by an earlier check are removed without a notification.
 
 ### DNS Hostname Monitoring (Subdomains)
 
@@ -136,8 +137,9 @@ notification endpoint set, changes show only on the dashboard; see
   lower case, because names are case-insensitive and nameservers may answer in
   any letter case. TXT and CAA values keep their letter case; they are not
   lower-cased.
-- Any observable change in any nameserver's response triggers a notification.
+- Any observable change in any nameserver's response triggers a notification,
-  This includes:
+  except a record change or an inconsistency for a domain or hostname listed in
+  `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS`. This includes:
     - **Record change**: A nameserver returns different records than it did on
       the previous check (additions, removals, value changes). For a domain or
       hostname listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS`, neither a
@@ -163,7 +165,8 @@ notification endpoint set, changes show only on the dashboard; see
       failed on it, and answers differently is reported on the check where it
       answers. So is a pair that differs in a record type whose query to either
       nameserver failed on the previous check. If a pair agrees again and later
-      disagrees, the alert is sent again.
+      disagrees, the alert is sent again. For a domain or hostname listed in
+      `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS`, no inconsistency is notified.
     - **CNAME address change**: The addresses at the end of a name's CNAME chain
       differ from those of the previous check. They are found when its
       nameservers answer with a CNAME and no address; a name that answers with
@@ -213,7 +216,9 @@ notification endpoint set, changes show only on the dashboard; see
 
 **Every observable state change produces a notification.** dnswatcher is
 designed as a real-time change feed — degradations, failures, recoveries, and
-routine changes are all reported equally.
+routine changes are all reported equally. A domain or hostname listed in
+`DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no record change or inconsistency
+notification.
 
 Supported notification backends: