output: distinguish nameserver resolution failures from domain errors

When an in-bailiwick nameserver cannot be resolved (no glue records and
iterative resolution fails), the traversal previously returned a generic
RespError. This made the Results section show many identical '6.7%
resulted in an error' lines and the Summary show '100% resulted in an
error' — even though the domain itself may be perfectly reachable in
practice via glue held by the registry.

Add a new RespNSResolutionFailed response type (string: ns_error)
for this specific case. Changes:

- traverse/response.go: add RespNSResolutionFailed, include it in
  IsTerminal() and String()
- traverse/traverser.go: use RespNSResolutionFailed with a descriptive
  ErrorMessage when ResolveNS fails in processReferral
- output/stats.go: map ns_error to nameserver lookup failed in
  summaryTypeLabel
- output/text.go: handle RespNSResolutionFailed in formatResultLine

Before:
  Results:     6.7% resulted in an error (x15)
  Summary:   100% resulted in an error

After:
  Results:     6.7% nameserver ns-a.hansenits.com.au could not be resolved (x15)
  Summary:   100% nameserver lookup failed

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: multica-agent <github@multica.ai>

internal/output/text_test.go

@@ -121,6 +121,7 @@ Answers: []miekgdns.RR{
 {"refused", traverse.RespREFUSED, nil, ""},
 {"notimp", traverse.RespNOTIMPL, nil, ""},
 {"cname_loop", traverse.RespCNAMELoop, nil, "loop detected"},
+{"ns_error", traverse.RespNSResolutionFailed, nil, "nameserver ns1.example.com could not be resolved"},
 {"error", traverse.RespError, nil, "something went wrong"},
 }