0.25.0 — DNS resolution check kind (KindDNS) + VPS monitoring fix

Adds a new 'dns' semantic monitoring kind that probes whether a DNS name
resolves. Uses net.LookupNS (NS records) with fallback to net.LookupHost
(A/AAAA). Supports an explicit server config for split-horizon resolution.

Changes:
- seeds/ontology.yaml: dns-zone monitoring: none → [dns] (was deferred
  since 2026-06 with a comment 'no dns checker exists yet')
- seeds/inventory.yaml: host:netbird-vps monitoring: [http] (was none;
  VPS was invisible for 7 days during the 2026-07-29 outage)
- internal/checkdefaults/defaults.go: add KindDNS, buildKind case for 'dns'
  that creates a check_def at 5-minute intervals
- internal/scheduler/scheduler.go: add checkDNS probe + wire in executeCheck

The DNS checker catches stale/unreachable zones (e.g. matrix.hubris.network
pointing to a dead VPS IP). The VPS HTTP check probes the public endpoint
every 60s, closing the 7-day monitoring gap.

seeds/ontology.yaml

@@ -381,11 +381,13 @@ entity_types:
     layer: infrastructure
     lifecycle: infrastructure
     description: DNS zone (e.g. split-horizon hubris.network).
-    monitoring: none             # no `dns` checker exists yet; declaring [dns]
-                                  # made every zone an unresolvable `unmonitored`
-                                  # signal. Flip back to [dns] when a checker lands.
-                                  # Requires ontology re-ingest to take effect;
-                                  # coverageSweep then auto-clears the stale signals.
+    monitoring: [dns]            # resolves the zone's apex via the configured
+                                  # resolver, verifying the zone is authoritatively
+                                  # reachable. (2026-08-05: was `none` — the DNS layer
+                                  # had zero checks, so a stale record like
+                                  # matrix→82.165.190.79 went unnoticed. Requires
+                                  # ontology re-ingest; coverageSweep clears stale
+                                  # signals after.)
     attributes: {type: object, properties: {zone: {type: string}, authority: {type: string}}}
   dns-record:
     parent: entity