feat(core): recursive DNS server after Java, measured with Java FILIUS

The resolver runs on the events now (a query, its dnsQueryTimeout, its
answer at the socket); the blocking resolveDns waits for it, and a
recursive server uses it: its own records, else the zone's name server
from its records, else its own DNS server, else a referral
(DNSServer.answerWithRemoteData).

DnsRun plays five stories on the new dns-recursive network. Measured and
not taken: a server that is its zone's name server asks itself, which asks
itself again, without end (the client times out, then every level floods
its own DNS server); Java guards only the step through its own DNS server.
The core asks itself in neither step. That story is compared up to the
client's query (JAVA_UNTIL).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/java-oracle/run.sh

@@ -141,6 +141,16 @@ for run in address:5000 mail:5000 referral:5000 unknown:5000 noServer:22000; do
         "$root/packages/core/test/scenarios/dns-lan.scenario.json" "$story" "${run##*:}" "$output" 2>&1 | grep -v 'logback\|^$' || true
     test -s "$output"
 done
+# The same with a recursive server (dns-recursive). unknownInOwnZone asks
+# itself without end: a short run, and a bounded heap.
+for run in address:5000 referral:5000 unknown:5000 unknownInZone:5000 unknownInOwnZone:15500; do
+    story="${run%%:*}"
+    output="$root/packages/core/test/scenarios/dns-recursive-java-$story.java.json"
+    rm -f "$output"
+    HOME="$here/.build/home" xvfb-run -a java -Xmx1g -cp "$classpath:$here/.build" DnsRun \
+        "$root/packages/core/test/scenarios/dns-recursive.scenario.json" "$story" "${run##*:}" "$output" 2>&1 | grep -v 'logback\|^$' || true
+    test -s "$output"
+done
 
 # ARP as Java FILIUS runs it: sends to addresses no card has on arp-routed's
 # network (ArpRun); frames and the calls, for the core's ARP comparison.