Port DNS64, VPN routing and DNS recovery ownership to master

Retain master's context-aware VPN and resolver APIs, per-program logger,
shutdown fencing, native CLAT service identity and firewall behavior.
Keep saved-DNS paths owned by the root ctrld package; isolate the added
ownership/sweep tests with a shared path seam and temporary backups.

Preserve the source DNS64 DNSSEC/cache gates, longest-suffix VPN routing,
DNS-journal convergence, scoped IPv6 handling, target ownership checks,
custom-listener regressions and documented native QA limits.

cmd/cli/dns_proxy.go

@@ -136,7 +136,7 @@ func (p *prog) addCachedResponse(key dnscache.Key, answer *dns.Msg) {
 }
 
 func (p *prog) cachedResponse(req *dns.Msg, upstream string, dns64Prefix netip.Prefix, dns64Active bool, now time.Time) (answer, stale *dns.Msg, hit, dns64Hit, dns64Bypass bool) {
-	if dns64Active {
+	if dns64Active && dns64RequestAllowed(req) {
 		if cachedValue := p.cache.Get(dns64CacheKey(req, upstream, dns64Prefix)); cachedValue != nil {
 			answer = cachedValue.Msg.Copy()
 			ctrld.SetCacheReply(answer, req, answer.Rcode)
@@ -2942,6 +2942,11 @@ func (p *prog) buildRecoveryUpstreams(reason RecoveryReason) map[string]*ctrld.U
 				upstreams[upstreamPrefix+k] = uc
 			}
 		}
+		// An OS-only configuration still needs a recovery worker. Do not add
+		// OS to mixed pools: their existing recovery boundaries stay intact.
+		if len(upstreams) == 0 {
+			upstreams[upstreamOS] = osUpstreamConfig
+		}
 	}
 	return upstreams
 }