tests: remove the DNS stand-ins from the watcher and resolver tests (closes #159)

The watcher tests used a stand-in resolver and the resolver timeout test
a stand-in DNS client, against the rule that DNS is never mocked. The
watcher tests now run the real resolver against live DNS. A change is
tested by saving values live DNS never returns (names under .invalid,
192.0.2.1) in the state a check starts from, or by marking a real
nameserver failed. The timeout test queries 192.0.2.1, where nothing
answers. The live-DNS retry and concurrency limit moved from the
resolver tests to internal/livedns, so both packages share them.
NewFromLoggerWithClient had no other use and is gone. TESTING.md and
the DNSClient comment now state the README's rule.

Model: opus-5-5

TESTING.md

@@ -4,10 +4,9 @@
 
 DNS is never mocked in this project, not in tests and not anywhere
 else; see the README section "No DNS mocking. Ever." Every test that
-looks something up in DNS **MUST** query live DNS servers, never a
-stand-in. Logic that works on record data, such as comparing or
-formatting records, may be tested on that data directly with no
-lookup.
+involves DNS **MUST** use live queries against real DNS servers: the
+resolver's tests, and the tests of code that uses the resolver, such
+as the watcher.
 
 ### Rationale
 

internal/resolver/resolver_test.go

@@ -528,10 +528,8 @@ func TestQueryNameserverIP_Timeout(t *testing.T) {
 	r := newTestResolver(t)
 
 	// Nothing answers at 192.0.2.1, a documentation address. The
-	// resolver tries each query twice; if the deadline has passed
-	// before the second try starts, the query is reported as nodata,
-	// not timeout. So the deadline must outlast the first try's
-	// two-second timeout.
+	// deadline must outlast one query timeout (two seconds): a query
+	// cut short by the deadline itself is not reported as a timeout.
 	ctx, cancel := context.WithTimeout(
 		context.Background(), 3*time.Second,
 	)