output: distinguish nameserver resolution failures from domain errors

When an in-bailiwick nameserver cannot be resolved (no glue records and
iterative resolution fails), the traversal previously returned a generic
RespError. This made the Results section show many identical '6.7%
resulted in an error' lines and the Summary show '100% resulted in an
error' — even though the domain itself may be perfectly reachable in
practice via glue held by the registry.

Add a new RespNSResolutionFailed response type (string: ns_error)
for this specific case. Changes:

- traverse/response.go: add RespNSResolutionFailed, include it in
  IsTerminal() and String()
- traverse/traverser.go: use RespNSResolutionFailed with a descriptive
  ErrorMessage when ResolveNS fails in processReferral
- output/stats.go: map ns_error to nameserver lookup failed in
  summaryTypeLabel
- output/text.go: handle RespNSResolutionFailed in formatResultLine

Before:
  Results:     6.7% resulted in an error (x15)
  Summary:   100% resulted in an error

After:
  Results:     6.7% nameserver ns-a.hansenits.com.au could not be resolved (x15)
  Summary:   100% nameserver lookup failed

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: multica-agent <github@multica.ai>

internal/output/stats.go

@@ -144,6 +144,8 @@ func summaryTypeLabel(respType string) string {
 		return "query type not implemented by server"
 	case "cname_loop":
 		return "resulted in a CNAME loop"
+	case "ns_error":
+		return "nameserver lookup failed"
 	case "error":
 		return "resulted in an error"
 	case "referral":