feat(dns): complete inspection UX

[ryanfowler]

Summary

• sort every DNS record family semantically and deterministically, including canonical HTTPS/SVCB parameters and numeric unknown RR types
• split DNS inspection orchestration, lookup/parsing, result rendering, and record rendering into focused files
• expand unit and CLI integration coverage for ordering, stream separation, complete and partial results, warnings, and exit codes
• update user documentation and bundled agent diagnostics guidance, and complete the side-by-side DNS/TLS UX review

Validation

• go test -v -parallel 8 ./...
• go test -race ./internal/dnsinspect ./integration
• CGO_ENABLED=0 go build .
• go mod verify
• staticcheck ./...
• live fetch --inspect-dns example.com / fetch --inspect-tls example.com comparison

Review

Two independent subagent review rounds were completed. Round-one findings were addressed; round two reported no actionable findings.