0.25.0 — DNS resolution check kind (KindDNS) + VPS monitoring fix

Adds a new 'dns' semantic monitoring kind that probes whether a DNS name
resolves. Uses net.LookupNS (NS records) with fallback to net.LookupHost
(A/AAAA). Supports an explicit server config for split-horizon resolution.

Changes:
- seeds/ontology.yaml: dns-zone monitoring: none → [dns] (was deferred
  since 2026-06 with a comment 'no dns checker exists yet')
- seeds/inventory.yaml: host:netbird-vps monitoring: [http] (was none;
  VPS was invisible for 7 days during the 2026-07-29 outage)
- internal/checkdefaults/defaults.go: add KindDNS, buildKind case for 'dns'
  that creates a check_def at 5-minute intervals
- internal/scheduler/scheduler.go: add checkDNS probe + wire in executeCheck

The DNS checker catches stale/unreachable zones (e.g. matrix.hubris.network
pointing to a dead VPS IP). The VPS HTTP check probes the public endpoint
every 60s, closing the 7-day monitoring gap.

internal/checkdefaults/defaults.go

@@ -33,6 +33,7 @@ const (
 	KindBackup     = "backup-freshness"
 	KindCertExpiry = "cert-expiry"
 	KindVMStatus   = "vm-status"
+	KindDNS        = "dns"
 )
 
 // defaultBackupMaxAge is how long a backup target may go without a new
@@ -306,6 +307,23 @@ func buildKind(kind string, t Target, attrs map[string]any, host, user string, p
 			interval: 60,
 		}}, ""
 
+	case KindDNS:
+		// Resolve the entity's name via DNS to verify the zone is reachable.
+		// Uses the entity name (zone apex) or falls back to the slug.
+		name := t.Name
+		if name == "" {
+			name = strings.TrimPrefix(t.Slug, "zone:")
+		}
+		if name == "" {
+			return nil, "no name to resolve"
+		}
+		return []checkDef{{
+			kind:     "dns",
+			config:   map[string]any{"name": name},
+			interval: 300, // 5 min — DNS changes are rare; the cost of a miss
+			               // is a stale IP, not a service outage.
+		}}, ""
+
 	case KindCertExpiry:
 		// The host whose cert to read (SNI / cert CN). Prefer an explicit
 		// `hostname` attribute, then `cn`, then a dotted name. Hourly: expiry