docs: add DNS resolver privacy evidence gates

[catcherintheroad-hub]

Summary

• Adds resolver privacy and log minimization evidence gates to dns-security.
• Covers QNAME minimization, EDNS Client Subnet forwarding, detailed DNS log retention, privacy exceptions, and managed resolver privacy statements.
• Adds edge-case fixtures showing how DNSSEC/DoT/RPZ can pass while resolver privacy still fails.

Created from review issue

Created from review issue: #1369

What was wrong

The skill could treat a recursive resolver as strong because DNSSEC, encrypted transport, RPZ filtering, and query logging were enabled. That misses privacy leaks from full QNAME forwarding, ECS client subnet forwarding, and long-lived detailed DNS logs.

What changed

• Added Step 6A: Resolver Privacy and Log Minimization.
• Added severity guidance for disabled QNAME minimization, ECS forwarding, and detailed log retention.
• Added a Resolver Privacy Posture output table.
• Added RFC 9156, RFC 7871, and RFC 8932 references.
• Added tests/resolver-privacy-edge-cases.md.

Validation

• git diff --check
• Added-line non-ASCII scan
• Added-line prompt-injection marker scan
• Markdown code-fence balance check
• RFC reference URL checks returned HTTP 200