Phase 4.1: Error handling, edge cases, and robustness

- Exponential backoff retry logic (100ms, 200ms, 400ms... capped at 2s)
  replacing fixed 100ms delay between retries
- Explicit REFUSED and NOTIMP response types (RespREFUSED, RespNOTIMPL)
  surfaced as terminal results with user-visible messages
- CNAME loop detection: walking the ancestor referral chain before
  following a CNAME prevents infinite recursion; produces RespCNAMELoop
- DNAME record support: synthesize CNAME target from DNAME mapping when
  the server omits the RFC 6672 synthesized CNAME record
- ErrorMessage field on Response for surfacing error details to users
- Fix resolveGlueViaSystem timeout bug: deadline.Sub(deadline) was
  always 0; replaced with time.Until(deadline)
- DNAME records excluded from hasFinalAnswer so DNAME-only responses
  are correctly classified as RespCNAMEFollow
- Text and JSON output updated with labels for all new response types
- Tests: CNAME loop (2-step and direct), REFUSED, NOTIMP, graceful
  degradation (partial and total server failure), DNAME synthesis,
  IsNameInChain, backoffDelay, ResponseClassification strings

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: multica-agent <github@multica.ai>

internal/traverse/referral.go

@@ -236,3 +236,17 @@ func getVisitedNames(visited map[string]bool) []string {
 	}
 	return names
 }
+
+// IsNameInChain reports whether name appears anywhere in this referral's ancestor
+// chain, including this referral itself. Used for CNAME loop detection.
+func (r *Referral) IsNameInChain(name string) bool {
+	n := miekgdns.Fqdn(strings.ToLower(name))
+	curr := r
+	for curr != nil {
+		if curr.Name == n {
+			return true
+		}
+		curr = curr.Parent
+	}
+	return false
+}