Add broker-controlled DNS identities

[Weidong Cui (wdcui)]

This PR adds broker-controlled static DNS identities by negotiating a provider-derived capability, serving bounded authoritative A responses over broker-owned UDP, pinning synthetic guest addresses to policy-authorized IPv4 destinations, and configuring resolver files through a one-shot filesystem hook. It also preserves UDP identity and accounting semantics and adds Linux-compatible IP_RECVERR and MSG_ERRQUEUE handling with unit and guest integration coverage.

[github-actions]

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure method_requires_different_generic_type_params: method now requires a different number of generic type parameters ---

Description:
A method now requires a different number of generic type parameters than it used to. Uses of this method that supplied the previous number of generic types will be broken.
        ref: https://doc.rust-lang.org/reference/items/generics.html
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.50.0/src/lints/method_requires_different_generic_type_params.ron

Failed in:
  litebox::fs::in_mem::FileSystem::with_root_privileges takes 2 generic types instead of 1, in /home/runner/work/litebox/litebox/litebox/src/fs/in_mem.rs:73

--- failure enum_no_repr_variant_discriminant_changed: enum variant had its discriminant change value ---

Description:
The enum's variant had its discriminant value change. This breaks downstream code that used its value via a numeric cast like `as isize`.
        ref: https://doc.rust-lang.org/reference/items/enumerations.html#assigning-discriminant-values
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.50.0/src/lints/enum_no_repr_variant_discriminant_changed.ron

Failed in:
  variant WireError::WrongMessagePhase 3 -> 4 in /home/runner/work/litebox/litebox/litebox_broker_protocol/src/wire.rs:74
  variant WireError::OffsetOverflow 4 -> 5 in /home/runner/work/litebox/litebox/litebox_broker_protocol/src/wire.rs:76

--- failure enum_struct_variant_field_added: pub enum struct variant field added ---

Description:
An enum's exhaustive struct variant has a new field, which has to be included when constructing or matching on this variant.
        ref: https://doc.rust-lang.org/reference/attributes/type_system.html#the-non_exhaustive-attribute
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.50.0/src/lints/enum_struct_variant_field_added.ron

Failed in:
  field capabilities of variant BrokerHandshakeResponse::Negotiated in /home/runner/work/litebox/litebox/litebox_broker_protocol/src/message.rs:67

--- failure enum_variant_added: enum variant added on exhaustive enum ---

Description:
A publicly-visible enum without #[non_exhaustive] has a new variant.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#enum-variant-new
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.50.0/src/lints/enum_variant_added.ron

Failed in:
  variant IpOption:RECVERR in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:813