fix(cli): keep Active Directory lookups off Control D's public resolver

The auto-added AD split rules route corp names to upstream.os, but a rule
match returned before the LAN-query marking, so osResolver raced the domain
controller against 76.76.2.0 and sent every AD lookup (DC hostnames,
DC-locator SRV names carrying the machine name, WPAD) there in plaintext.
Mark a matched query under the machine's AD domain whose upstreams are the
OS resolver alone as a LAN query, which drops 76.76.2.0 for it.

docs/internal-domains.md

@@ -94,6 +94,16 @@ exists for a source is never overwritten. From highest precedence to lowest:
    rule, so an Internal Domain for the AD domain takes precedence over the
    auto-detected one.
 
+   A query under the AD domain whose matched rule resolves to the OS resolver
+   alone (the auto-detected rule, a Magic Folder exclude, or an OS-resolver
+   Internal Domain) is a LAN query, so the OS resolver does not race Control D's
+   public resolver (76.76.2.0) against the domain controller. Before this, a
+   rule match returned ahead of the LAN classification and every such lookup
+   (DC hostnames, DC-locator SRV names that carry the machine name, WPAD) also
+   went to 76.76.2.0 in plaintext; when both failed, the public NXDOMAIN could
+   be the answer returned. An explicit-resolver rule for the AD domain is
+   unchanged.
+
 **VPN DNS auto-detection** is evaluated inside `proxy()` in DNS-intercept mode,
 after policy matching and independently of it, so it needs its own rule: