server: canary DNS — authoritative zone with frozen §6.1 reference records

Stdlib DNS responder (no external deps): parses single-question queries
with EDNS OPT (bufsize, DO, ECS), serves the spec's frozen reference
records (ttl-{5,60,3600,86400} A/AAAA/TXT, many-rr 8×A in order, big-txt
~1800B), and per-query <nonce>.<session>.<zone> answers in 192.0.2.0/24.
UDP truncation sets TC past 512 (or the EDNS bufsize); TCP never
truncates — the EDNS-bufsize / TCP-fallback test. Every query is logged
(qname, resolver, transport, EDNS, ECS, case) and surfaced per session
prefix in GET /v1/sessions/{id}/observations as dns_canary. Profile gains
canary_zone + the canary-dns capability when configured.

Wire format validated against an independent client (correct rcodes,
answer counts, TC behavior, full EDNS response); unit tests cover
references, truncation-vs-EDNS, logging, NXDOMAIN.

Versioning: patch-first convention recorded in CLAUDE.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -30,6 +30,13 @@ is the mutable one — update it as work lands.
 
 Keep prober result IDs aligned with the measurement-schema test-type registry.
 
+## Versioning
+
+Prefer **patch** bumps (`server-v0.3.1`) for additive/incremental work; reserve **minor** bumps
+for real milestones. Don't burn through minor versions. Tags are namespaced: `server-v*` for the
+Go server, `v*` for the app. Pushing a `server-v*` tag runs CI → binaries + Gitea release +
+registry image; the server on fmr can `--self-update` from those releases.
+
 ## Layout
 
 Monorepo. The prober is one deliverable; the Go server and the production app land as siblings.