feat(scanner): add retry on timeout to reduce false negatives

[nightowlnerd]

Summary

• Scanner now retries DNS queries once on timeout (UDP packet loss), recovering IPs that
  would otherwise be falsely rejected
• Only timeout errors trigger retry — non-timeout failures (refused, hijacking, empty
  response) fail immediately
• Benchmarker unchanged — already resilient via 20 queries + threshold filtering

Details

• New ScanRetries constant (1 retry = 2 total attempts per IP)
• isTimeout() helper checks both net.Error interface and string matching
• Retry covers both A-record probe and TXT domain verification phases

Test plan

• TestE2ERetryOnTimeout — flaky server drops 1st request, retry recovers
• TestE2ERetryExhausted — all retries fail, IP correctly rejected
• TestE2ERetryDomainVerification — A-record retry + TXT passes
• TestE2ERetryDomainVerificationTXTTimeout — both A and TXT retry via alternating-drop
  server
• TestIsTimeout — unit test for timeout detection
• Full suite (43 tests) passing