output: distinguish nameserver resolution failures from domain errors

When an in-bailiwick nameserver cannot be resolved (no glue records and
iterative resolution fails), the traversal previously returned a generic
RespError. This made the Results section show many identical '6.7%
resulted in an error' lines and the Summary show '100% resulted in an
error' — even though the domain itself may be perfectly reachable in
practice via glue held by the registry.

Add a new RespNSResolutionFailed response type (string: ns_error)
for this specific case. Changes:

- traverse/response.go: add RespNSResolutionFailed, include it in
  IsTerminal() and String()
- traverse/traverser.go: use RespNSResolutionFailed with a descriptive
  ErrorMessage when ResolveNS fails in processReferral
- output/stats.go: map ns_error to nameserver lookup failed in
  summaryTypeLabel
- output/text.go: handle RespNSResolutionFailed in formatResultLine

Before:
  Results:     6.7% resulted in an error (x15)
  Summary:   100% resulted in an error

After:
  Results:     6.7% nameserver ns-a.hansenits.com.au could not be resolved (x15)
  Summary:   100% nameserver lookup failed

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: multica-agent <github@multica.ai>

internal/traverse/response_test.go

@@ -246,6 +246,7 @@ func TestResponseIsTerminal(t *testing.T) {
 		{RespNXDOMAIN, true},
 		{RespSERVFAIL, true},
 		{RespError, true},
+		{RespNSResolutionFailed, true},
 		{RespReferral, false},
 		{RespCNAMEFollow, false},
 	}
@@ -272,6 +273,7 @@ func TestResponseTypeString(t *testing.T) {
 		{RespNXDOMAIN, "nxdomain"},
 		{RespSERVFAIL, "servfail"},
 		{RespError, "error"},
+		{RespNSResolutionFailed, "ns_error"},
 	}
 
 	for _, tt := range tests {