audit 4: DNS outages unknown, DMARC limits said, typed Health, one TLS mode per upstream

M14, M15: queryEach gives each resolver 2 s within the check's context and
asks the one that answered last first; an address or PTR lookup not
answered is Unknown, an answered mismatch beside it still an error;
Checker.Server keeps the last answer's addresses, so SPF does not go Unknown
with it. Notifications report faults only, now tested with SPF unknown
alone and beside a wrong DKIM.

DMARC reports: tests of malformed XML, gzip and zip bombs, a message over
the limit, the service's Resync, hosted suggestion and validation. The
finding: both limits cut silently and an oversized report failed as
damaged; readAtMost refuses it for its size (MaxMessage 10 MiB, moved into
IngestMessage).

healthReadings replaces map[string]any for Health and Overview.

L5: an inbound upstream has one TLS mode - a second domain to the same
[host]:port with another mode is refused, naming the first; the TLS policy
map holds each next hop once.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 631 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -73,6 +73,23 @@ Migration `0011` (a table, nothing existing changes).
   next check sends it to those who did not get it, once; a user added while
   the problem is open is not mailed about it; "it is over" goes to those
   who were told.
+- **A DNS resolver that dropped packets made the checks report records as
+  wrong.** The first resolver had the whole check's five seconds, so the
+  others were asked with no time left; a lookup that was not answered then
+  read as "does not resolve" or "no PTR record", and the server's addresses
+  were dropped, so every domain's SPF went unknown with it. Each resolver
+  now has 2 seconds of its own and the one that answered last is asked
+  first; an unanswered lookup is *unknown*, the addresses the last answer
+  gave are kept, and notifications report what is wrong, never what is not
+  known (audit 2026-10-12, M14, M15).
+- **A DMARC report too large was refused as a broken one.** A message over
+  10 MiB, or a report that unpacked past 8 MiB, was cut at the limit and then
+  failed as damaged; it is now refused for its size, and `mail.log` says so.
+- **Two inbound domains to one upstream with different TLS modes** wrote two
+  policy lines for one next hop, and Postfix used the first; the form's
+  choice for the other domain did nothing. Saving the second is refused,
+  naming the domain whose mode the upstream has, and the policy map holds
+  each next hop once (audit 2026-10-12, L5).
 
 ## [2.5.3] - 2026-10-15