cmd/cli: ensure set/reset DNS is done before checking OS resolver

Otherwise, new DNS settings could be reverted by dns watchers, causing
the checking will be always false.

cmd/cli/resolvconf.go

@@ -40,7 +40,7 @@ func (p *prog) watchResolvConf(iface *net.Interface, ns []netip.Addr, setDnsFn f
 			mainLog.Load().Debug().Msgf("stopping watcher for %s", resolvConfPath)
 			return
 		case event, ok := <-watcher.Events:
-			if p.leakingQuery.Load() {
+			if p.leakingQuery.Load() || p.um.isChecking(upstreamOS) {
 				return
 			}
 			if !ok {