…ix wins

`buildAllowNetDNSZones` had three independent bugs that combined to
silently sinkhole allow-listed hostnames inside the guest, returning
0.0.0.0 for the lifetime of the box:

1. **No retry/timeout on host-side resolution.** Each allow-listed
   hostname was resolved exactly once with `context.Background()` and
   no timeout. A momentary host hiccup (VPN flap, slow corp resolver,
   mDNSResponder churn) silently dropped the zone, and the symptom
   `allow_zones=N-1 total_zones=N` was the only signal — a warning
   most callers never noticed. Now: 4 attempts with exponential
   backoff (100/300/900/2700 ms) and a 2 s per-attempt deadline.
   Successful retries log `INFO allowNet: DNS resolution succeeded
   after retry`.

2. **Silent half-baked sinkhole.** When resolution definitively
   failed, the zone was just dropped and box.create proceeded as if
   nothing was wrong — producing a sinkhole that would 0.0.0.0
   exactly the host the caller said they needed. Now: the resolver
   error propagates through `buildAllowNetDNSZones` →
   `buildDNSZones` → `buildTapConfig` → `gvproxy_create`, surfaced
   to the Rust caller via the new `errOut` channel from boxlite-ai#612 so the
   user-visible BoxliteError says
   `allowNet: resolve "iapi.example.com": ...` instead of
   "krun_start_enter returned: -22".

3. **Map-iteration zone order vs first-suffix-wins matcher.**
   gvisor-tap-vsock's DNS handler matches zones first-suffix-wins
   with no most-specific-match preference (services/dns/dns.go:51).
   We were emitting zones in Go map iteration order — random per
   process. With an allow-list of `[github.com, api.github.com,
   iapi.merck.com]`, an `iapi.merck.com.` query would sometimes hit
   the `com.` zone first (because `github.com` lives there), find no
   matching record name, and return that zone's
   `DefaultIP=0.0.0.0`. The same query hit `merck.com.` first on
   other runs and resolved correctly — explaining the "intermittent"
   reports. Now: zones are sorted longest-name-first before the
   slice is built, so the most-specific suffix always wins, and the
   catch-all root zone stays last.

Also adds two pieces of operability that made this debuggable:

- A build-identity log line on the first `gvproxy_create` of a shim
  process: `INFO gvproxy-bridge: build identity build_id=… vcs_revision=…
  vcs_modified=… go_version=…`. Lets a user confirm whether a freshly
  built shim is actually what's loaded — without it, "did the rebuild
  take effect?" is answered by guesswork.
- An `INFO allowNet: host resolved` line per allow-listed hostname,
  with the resolved IP list and v4 count. Visible at INFO so
  zero-IPv4 / IPv6-only hosts no longer hide.

Tests added (in `dns_filter_test.go`):

- `RetriesTransientResolverFailure` — flaky resolver that fails the
  first 2 attempts then succeeds; asserts retry recovers and bakes
  the host's records.
- `FailsClosedAfterRetries` — always-fail resolver; asserts the
  N-attempts-then-error contract (no zone with `Default=0.0.0.0`
  silently shipped).
- `HonorsPerAttemptTimeout` — hanging resolver that blocks until
  ctx cancellation; asserts the per-attempt deadline fires (without
  this, an unresponsive corp DNS server hangs box.create
  indefinitely).
- `PerHostFailureFailsAggregate` — multi-host allow-list where one
  host permafails; asserts the whole sinkhole build aborts and the
  failing host is named in the error.
- `LongestSuffixWinsBeforeRoot` — pins the bug-3 fix: with
  `[github.com, api.github.com, raw.githubusercontent.com,
  codeload.github.com, iapi.merck.com]`, asserts every per-TLD zone
  precedes the `com.` zone in the output slice, so the
  first-match-wins matcher sees `merck.com.` before `com.`.

The retry-loop timing constants are exposed as package-level `var`s
so tests can override them without slowing the suite (the timing
contract is what's pinned, not the specific durations).

Two-side verification: with the production changes reverted but the
new tests kept, the four reproducer tests fail with the expected
signals (`expected retry to recover`, `expected 4 attempts got 1`,
hangs to the 60s suite timeout, and `LongestSuffixWinsBeforeRoot`'s
ordering assertion); restore the changes and all pass.

Docs updated:

- `docs/faq.md` — new Networking entry
  "An allow_net host resolves to 0.0.0.0 inside the box" with
  diagnostic steps (where the gvproxy log lives, what
  `allow_zones=N-1 total_zones=N` looks like vs the new retry/fail
  warnings, why the sinkhole is baked once at create time and
  recreating the box — not restarting it — is what propagates a
  fix).
- `docs/reference/README.md` — bullet under the `network` notes
  describing host-side pre-resolution, retries, and fail-closed
  behavior so callers know `allow_net` entries must be
  resolvable on the host before `box.create`.

…erage

Fixes the broken `LongestSuffixWinsBeforeRoot` test (it called the real
resolver and died with NXDOMAIN on every machine outside Merck corp DNS,
so the test failed for the wrong reason and never actually exercised
the sort logic). Adds three more tests to cover the gaps an audit
flagged in boxlite-ai#645:

  - LongestSuffixWinsBeforeRoot now drives buildAllowNetDNSZonesWith()
    with a fixedIPResolver. Same assertions on zone ordering, but
    hermetic — no network dependency, no public DNS lookup.

  - CatchAllRootZoneAlwaysLast pins the invariant the dns_filter.go
    comments state ("Catch-all root zone: sinkhole everything not
    explicitly allowed") but no test ever asserted. Runs across 0/1/4
    host configurations as sub-tests.

  - BuildTapConfig_DNSResolutionFailure_PropagatesErrorNotSilentConfig
    is the end-to-end leg covering buildAllowNetDNSZones →
    buildTapConfig. Drives the chain with an RFC 6761 `.invalid` host
    (guaranteed NXDOMAIN), overrides dnsLookupAttemptTimeoutVar to
    keep the test fast, asserts (err != nil) AND (tapCfg == nil) AND
    err mentions the failing hostname.

  - BuildTapConfig_NoAllowNet_HappyPath_NoDNSLookup is the negative
    control — if a regression makes buildTapConfig hit the resolver
    even when allow_net is empty, the test trips a 50ms upper bound
    on elapsed time instead of silently passing.

  - BuildTapConfig_ProductionSymptomReproducer is the operator-shaped
    reproducer: N=3 allow_net hosts where 2 resolve and 1 doesn't.
    Failure message names the exact production symptom shape
    ("silent half-baked config with allow_zones=N-1 total_zones=N")
    so a future regression review immediately knows what was lost.

Two-sided verified by toggling production lines:
  - Toggle `sort.Slice(... > ...)` to `<`: LongestSuffixWinsBeforeRoot
    flips red ("github.com. must precede com.")
  - Toggle `return nil, lastErr` to `return nil, nil` in lookupWithRetry:
    ProductionSymptomReproducer flips red with the literal "REGRESSION —
    fix gone: ... allow_zones=3 total_zones=4" message it was designed
    to surface.
  - Toggle the catch-all root zone from `append` (end) to prepend
    (start): CatchAllRootZoneAlwaysLast flips red on the 3 non-empty
    sub-tests (the 0_hosts sub-test stays green because there's no
    other zone to displace it).

Coverage delta:
  +149 lines of new tests + 1 mock resolver (fixedIPResolver, ~5 lines).
  All 14 tests now green on a public-internet host. PR boxlite-ai#645's original
  4 tests (RetriesTransientResolverFailure, FailsClosedAfterRetries,
  HonorsPerAttemptTimeout, PerHostFailureFailsAggregate) unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>