feat: DNS host selection - system resolver, --dns-upstream flag, root hints

- Replace hardcoded 127.0.0.1:53 in systemResolver() with actual system
  DNS from /etc/resolv.conf (falls back to 127.0.0.1:53 if unavailable)
- Add Resolver field to RootDiscoveryConfig so callers can override the
  upstream resolver used during root server discovery
- Add --dns-upstream flag (e.g. --dns-upstream 8.8.8.8:53) to exploredns
  CLI and DNSUpstream field to Config
- Add internal/dns/hints.go with all 13 IANA root server IPv4/IPv6
  addresses as embedded constants (RootHints []RootServer)
- Update tests: fix real_exchange_test.go call site; add hints_test.go
  covering RootHints correctness and resolver helper functions

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: multica-agent <github@multica.ai>

internal/config/config.go

@@ -28,15 +28,18 @@ type Config struct {
 	AllRootServers bool
 	RootAAAA       bool
 	FollowAAAA     bool
-	UDPSize        int
-	AllowTCP       bool
-	AlwaysTCP      bool
-	MaxDepth       int
-	Retries        int
-	Fast           bool
-	Verbose        bool
-	Debug          int
-	Quiet          bool
+	// DNSUpstream is the upstream resolver used for root server discovery.
+	// Format: "host:port" (e.g. "8.8.8.8:53"). Empty means use the system resolver.
+	DNSUpstream string
+	UDPSize     int
+	AllowTCP    bool
+	AlwaysTCP   bool
+	MaxDepth    int
+	Retries     int
+	Fast        bool
+	Verbose     bool
+	Debug       int
+	Quiet       bool
 
 	ShowProgress       bool
 	ShowResolves       bool
@@ -173,6 +176,7 @@ func PrintUsage() {
 			{"--all-root-servers", "Use all 13 root servers"},
 			{"--root-aaaa", "Include IPv6 root addresses"},
 			{"--follow-aaaa", "Only follow AAAA for referrals"},
+			{"--dns-upstream", "Upstream resolver for root discovery (default: system)"},
 		},
 		"Transport Options": {
 			{"--udp-size", "EDNS0 buffer size (default 2048)"},
@@ -220,6 +224,7 @@ func DefaultConfig() *Config {
 		AllRootServers:     false,
 		RootAAAA:           false,
 		FollowAAAA:         false,
+		DNSUpstream:        "",
 		UDPSize:            2048,
 		AllowTCP:           true,
 		AlwaysTCP:          false,