DNS is never mocked in dnswatcher — not in tests, not anywhere.
Tests run against the real DNS by design; flaky live tests get
fixed with robustness or owner-decided opt-in gating, never mocks.
Record this prominently near the top of the README so contributors
and future workers do not propose mocked resolvers.
