watcher, config: no Record Change or Inconsistency for listed names (closes #255)

DNSWATCHER_SKIP_RECORD_NOTIFICATIONS takes a comma-separated list of
names from DNSWATCHER_TARGETS, read as the targets are (letter case,
trailing dot, repeats). For a listed name no Record Change and no
Inconsistency notification is sent; its records are still checked and
saved, and its other notifications are sent. A listed name that is not
a target stops startup with an error naming it.

The two detections return early for a listed name. Apex domains are
covered too: their own records go through the same detection.

Live DNS cannot be made to disagree on purpose, so the Inconsistency
test feeds records to the change detection directly, as the existing
inconsistency tests do; the live test covers Record Change.

Model: opus-5-5

README.md

@@ -192,9 +192,13 @@ notification endpoint set, changes show only on the dashboard; see
 - Any change in port availability triggers a notification:
     - Port transitioned from open to closed (or vice versa).
     - New IP appeared (from DNS change): its port state is recorded without a
-      port notification; the DNS change notification shows the new address.
+      port notification; the DNS change notification shows the new address. A
+      domain or hostname listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets
+      no notification for an address added to its own A or AAAA records.
     - IP disappeared (from DNS change) — noted in the DNS change notification;
-      port state for that IP is removed. When none of a name's nameservers
+      port state for that IP is removed. A domain or hostname listed in
+      `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` gets no notification for an address
+      removed from its own A or AAAA records. When none of a name's nameservers
       answered, its addresses are not known, so the port state saved for them is
       kept.
 
@@ -795,7 +799,9 @@ docker run -d \
       nameservers answered, the addresses an earlier check found at the end of
       the chain are used.
 4. **On change detection**: Send notifications to all configured endpoints,
-   update in-memory state, persist to disk.
+   update in-memory state, persist to disk. A record change or inconsistency for
+   a domain or hostname listed in `DNSWATCHER_SKIP_RECORD_NOTIFICATIONS` sends
+   no notification, but the state is still updated and saved.
 5. **Shutdown**: The watcher stops checking and saves the final state to disk,
    and shutdown waits for that save before it goes on. Then it waits for
    in-flight notification deliveries to complete. Both waits share the fx