- Fast mode cache isolation: TraverserConfig.Fast=false gives each
referral its own independent InfoCache with no cross-branch glue
inheritance; Fast=true (default) retains the shared root cache so
earlier branch discoveries are reused
- Wire cfg.Fast from CLI config into TraverserConfig in main.go
- IDN/Punycode: NewReferral now converts unicode domain labels to their
ACE/punycode form via golang.org/x/net/idna before querying, with a
graceful fallback when conversion fails
- DNSSEC: hasFinalAnswer() now skips RRSIG records alongside CNAME so
a signed referral does not prevent CNAME following
- Tests: DNSSEC RRSIG does not block CNAME follow, fast/non-fast cache
isolation, 12-NS referral, IDN conversion, wildcard answer, long CNAME
chain depth limit, partial branch failure with graceful degradation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: multica-agent <github@multica.ai>