fix(checkers): retry transient DNS failures instead of burning the whole check budget

[fclairamb]

Problem

Checks sporadically fail with failed to resolve hostname: lookup <host>: i/o timeout at exactly ~5001ms (e.g. the hourly SSL check on ts-seminor.abyla.fr, org stonaltech, k8xp dev). Over 48h: 39 such errors out of 561k results, across all regions and many unrelated hostnames.

Root cause chain:

1. Fast checks get the cost-aware timeout floor of 5s (CostTimeoutFloorMs: 5000) as their whole budget.
2. The stdlib resolver's per-exchange DNS timeout is also 5s (resolv.conf default), so one lost DNS UDP packet stalls resolution for the entire check budget — no retry ever fires.
3. On the k8xp cluster the DNS path crosses intercontinental WireGuard hops as single UDP packets (companion infra fix: node-local CoreDNS in the k8xp repo), but any deployment with occasional DNS packet loss reproduces this.

Fix

New checkerdef.LookupIPAddr: up to 3 attempts × 1.5s, retrying only transient errors (timeout / temporary), immediate return on NXDOMAIN or cancellation. Re-issued lookups leave from a fresh source port (new conntrack flow, often a different DNS server), so a retry is genuinely a second chance rather than more waiting. Worst case 4.5s still fits the 5s floor.

Wired into the nine checkers where resolution is a precondition: ssl, imap, smtp, pop3, udp, sip, tcp, ssh, icmp. checkdns / checkdnsbl untouched — their lookups are the measurement. Per-checker error messages unchanged.

Testing

• New unit tests for the retry loop (injectable lookup): first-try success, retry-then-success, no retry on NXDOMAIN/non-DNS errors, max-attempts cap, parent-context stop, IP-literal passthrough, transient-error classification.
• go test green on all touched packages; golangci-lint clean.

🤖 Generated with Claude Code