feat(namesys): propagate DNSLink TXT TTL

[lidel]

Problem

boxo's DNS resolver discards the TTL of DNSLink TXT records and returns 0. The gateway sets Cache-Control: max-age for mutable paths only when the TTL is non-zero, so DNSLink (/ipns/<dnslink-host>) responses go out with no max-age and fall back to a static value, even though the TXT record states exactly how long the mapping is valid (#329). Recursive names made it worse: a name resolved through several records was cached for only its final hop's TTL, ignoring shorter-lived links earlier in the chain.

Fix

• Carry the TXT record TTL into the resolved result (AsyncResult.TTL / Result.TTL), which the gateway turns into Cache-Control: max-age.
• WithDNSResolver auto-detects a resolver that implements madns.TXTWithTTLResolver; NewDNSResolverWithTTL, WithDNSResolverWithTTL, and LookupTXTWithTTLFunc take a TTL-aware lookup directly. Shipped end to end: go-multiaddr-dns v0.6.0 defines the interface, go-doh-resolver v0.6.0 implements it, both are pinned here, and a compile-time assertion in gateway makes a future drift break the build instead of silently dropping TTLs.
• Cap a resolved name's TTL to its shortest hop, so a DNSLink pointing at an IPNS name, or a recursive IPNS chain, is not cached past its earliest-expiring link. Hops with an unknown TTL (0) are ignored.
• WithMaxCacheTTL now also caps the TTL reported in results (making Kubo's documented Ipns.MaxCacheTTL behavior true in emitted headers), and cache hits report the entry's remaining lifetime instead of its original TTL, so a late hit no longer restarts the full caching period. A cap of 0 still means "no local cache" and leaves the TTL alone (Kubo's offline mode relies on that); the gateway sharness workflow now also watches namesys/ipns/path so a regression there cannot slip through untested again.

NewDNSResolver and LookupTXTFunc keep their signatures and report an unknown TTL (0). TTLs flow only for domains resolved through DoH¹; everything else keeps today's static behavior. Independent of DoH, two changes apply to all namesys users: the WithMaxCacheTTL cap and remaining-lifetime cache hits.

Part of #329. ETag for resolved paths (the issue's other half) is out of scope.

Footnotes

1. The OS resolver cannot report TTLs: Go's net.Resolver returns only record values, and madns.DefaultResolver wraps it. In Kubo, a DNS.Resolvers entry for . routes every lookup through DoH. ↩

[codecov]

Codecov Report

❌ Patch coverage is 84.84848% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 63.83%. Comparing base (441032d) to head (ad14954).

Files with missing lines	Patch %	Lines
namesys/namesys.go	44.44%	4 Missing and 1 partial ⚠️

@@            Coverage Diff             @@
##             main    #1167      +/-   ##
==========================================
- Coverage   63.87%   63.83%   -0.04%     
==========================================
  Files         269      269              
  Lines       27073    27097      +24     
==========================================
+ Hits        17293    17298       +5     
- Misses       8072     8083      +11     
- Partials     1708     1716       +8     

Files with missing lines	Coverage Δ
gateway/dns.go	67.56% <ø> (ø)
namesys/dns_resolver.go	73.68% <100.00%> (+1.46%)	⬆️
namesys/namesys_cache.go	62.50% <100.00%> (+6.94%)	⬆️
namesys/utilities.go	91.66% <100.00%> (+0.87%)	⬆️
namesys/namesys.go	57.89% <44.44%> (-2.11%)	⬇️

... and 10 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.