Add DNS delegation integrity gates

[Desalzes]

Summary

Fixes #1627.

This strengthens dns-security so DNSSEC, resolver, and protective-DNS checks do not accidentally pass a zone whose authoritative delegation is unsafe. The skill now requires parent/child NS consistency, glue A/AAAA validation, authoritative response checks, SOA serial consistency, delegated NS ownership evidence, and AXFR/IXFR restrictions.

Changes

• Added an Authoritative Delegation Integrity Review step.
• Added evidence gates for parent/TLD NS versus child apex NS sets, in-bailiwick glue, IPv4/IPv6 parity, lame nameservers, SOA drift, delegated NS control, and zone transfer restrictions.
• Added DNS-DELEG-01 through DNS-DELEG-05 finding IDs with severity guidance.
• Added an Authoritative Delegation Integrity output table.
• Expanded severity classification and common pitfalls for stale glue, lame nameservers, dangling delegated NS, and public AXFR.
• Added a changelog entry and version bump.

Validation

• git diff --check
• frontmatter required-field check
• prompt-injection pattern scan for the modified skill
• markdown fence balance check