Fix NS resolution, deduplicate results, fix FormatRecord duplication

Three bugs fixed:

1. processReferral was calling ResolveNS with ref.Name (the query domain,
   e.g. '800adventures.com.au.') instead of ref.Bailiwick (the NS hostname,
   e.g. 'ns-a.hansenits.com.'). This caused the sub-traversal to look up the
   wrong name and always fail to find the nameserver's IP address.

2. In ResolveNS (and Referral.Resolve), child referrals whose name matched the
   visited set were unconditionally skipped. When the .com TLD returns glue A
   records for the target NS alongside its delegation, the child referral has
   addresses and should be queried directly rather than skipped.

3. FormatRecord was prepending the DNS header fields and then appending
   rr.String() which already includes those same fields, producing doubled
   output like 'example.com. 300 IN A example.com. 300 IN A 1.2.3.4'.
   Now simply returns rr.String().

Additional improvements:
- Results section deduplicates terminal results: same NS failure or same
  (NS, answer) pair is merged with summed probability, avoiding the same
  nameserver appearing 15 times with 6.7% each.
- Result lines now include the NS hostname (from Bailiwick) and use the
  compact rdata format, e.g. '33% ns-a.hansenits.com answered with 13.54.63.231'.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: multica-agent <github@multica.ai>

internal/traverse/traverser.go

@@ -227,15 +227,19 @@ func (t *Traverser) processReferral(ctx context.Context, ref *Referral, cache *I
 		}
 		t.mu.Unlock()
 
-		ref.Addresses = t.resolveGlueViaSystem(ctx, ref.Name, cache)
+		// Resolve the nameserver's IP address. The NS hostname is stored in
+		// Bailiwick; ref.Name is the domain being queried (not the NS name).
+		nsToResolve := ref.Bailiwick
+		if nsToResolve == "" || nsToResolve == "." {
+			nsToResolve = ref.Name
+		}
+		nsName := strings.TrimSuffix(nsToResolve, ".")
+
+		ref.Addresses = t.resolveGlueViaSystem(ctx, nsToResolve, cache)
 		if len(ref.Addresses) > 0 {
 			ref.State = StateResolved
 		} else {
-			addrs, err := t.ResolveNS(ctx, ref.Name, cache, visitedCopy, t.depth)
-			nsName := strings.TrimSuffix(ref.Bailiwick, ".")
-			if nsName == "" || nsName == "." {
-				nsName = strings.TrimSuffix(ref.Name, ".")
-			}
+			addrs, err := t.ResolveNS(ctx, nsToResolve, cache, visitedCopy, t.depth)
 			if err != nil {
 				return &Response{
 					Referral:     ref,
@@ -375,7 +379,10 @@ func (t *Traverser) ResolveNS(ctx context.Context, nsName string, cache *InfoCac
 		if resp.Type == RespReferral {
 			children := resp.ChildReferrals()
 			for _, child := range children {
-				if visited != nil && visited[child.Name] {
+				// Only skip visited names when they have no addresses; if glue
+				// was included in the referral response we still need to query
+				// that child to get the authoritative answer.
+				if visited != nil && visited[child.Name] && !child.HasAddresses() {
 					continue
 				}
 				if !stack.Push(child) {