tests: remove the DNS stand-ins from the watcher and resolver tests (closes #159)

The watcher tests used a stand-in resolver and the resolver timeout test
a stand-in DNS client, against the rule that DNS is never mocked. The
watcher tests now run the real resolver against live DNS. A change is
tested by saving values live DNS never returns (names under .invalid,
192.0.2.1) in the state a check starts from, or by marking a real
nameserver failed. The timeout test queries 192.0.2.1, where nothing
answers. The live-DNS retry and concurrency limit moved from the
resolver tests to internal/livedns, so both packages share them.
NewFromLoggerWithClient had no other use and is gone. TESTING.md and
the DNSClient comment now state the README's rule.

Model: opus-5-5

TESTING.md

@@ -4,9 +4,10 @@
 
 DNS is never mocked in this project, not in tests and not anywhere
 else; see the README section "No DNS mocking. Ever." Every test that
-involves DNS **MUST** use live queries against real DNS servers: the
-resolver's tests, and the tests of code that uses the resolver, such
-as the watcher.
+looks something up in DNS **MUST** query live DNS servers, never a
+stand-in. Logic that works on record data, such as comparing or
+formatting records, may be tested on that data directly with no
+lookup.
 
 ### Rationale
 

internal/resolver/resolver_test.go

@@ -528,8 +528,10 @@ func TestQueryNameserverIP_Timeout(t *testing.T) {
 	r := newTestResolver(t)
 
 	// Nothing answers at 192.0.2.1, a documentation address. The
-	// deadline must outlast one query timeout (two seconds): a query
-	// cut short by the deadline itself is not reported as a timeout.
+	// resolver tries each query twice; if the deadline has passed
+	// before the second try starts, the query is reported as nodata,
+	// not timeout. So the deadline must outlast the first try's
+	// two-second timeout.
 	ctx, cancel := context.WithTimeout(
 		context.Background(), 3*time.Second,
 	)