Read-only ActivityPub → atproto bridge for the threadiverse using Coves lexicons

feat(dns): answer A and AAAA for bridged handles and refuse zone transfers master

Instance apexes and the names one label below them answer A with DNS_PUBLIC_IPV4, and AAAA with DNS_PUBLIC_IPV6 when it is set, at a 300-second TTL and without a store lookup. Deeper names get NODATA. AXFR and IXFR for any in-zone name are refused. The e2e stack runs the DNS server on 127.0.0.1:5380 (UDP and TCP), and TestDNS_BridgedHandleAndTombstone resolves a minted actor's _atproto TXT record, then checks the answer is empty once the actor is tombstoned. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>