fix(cli): mark AD lookups on the bypass and OS retry paths

The previous change marked a rule-matched AD query as a LAN query, but
two paths still reach the OS resolver without that mark, so osResolver
raced the domain controller against 76.76.2.0 in plaintext:

  - the DNS-intercept recovery bypass, which forwards queries before
    rule handling runs
  - the OS-resolver retry catch-all after an explicit upstream fails
    with leak_on_upstream_failure enabled

Mark a query under the detected AD domain on both paths. Other names
keep the public fallback, and an explicit upstream is still tried first.

Build resolvers in queryUpstream() through newResolverFn, so tests drive proxy()
and assert the LAN mark that reaches each resolver, instead of testing
the predicate alone.

docs/internal-domains.md

@@ -102,7 +102,10 @@ exists for a source is never overwritten. From highest precedence to lowest:
    (DC hostnames, DC-locator SRV names that carry the machine name, WPAD) also
    went to 76.76.2.0 in plaintext; when both failed, the public NXDOMAIN could
    be the answer returned. An explicit-resolver rule for the AD domain is
-   unchanged.
+   unchanged. The same LAN mark applies wherever an AD name reaches the OS
+   resolver outside rule handling: the DNS-intercept recovery bypass, and the
+   OS-resolver retry after an explicit upstream fails with
+   `leak_on_upstream_failure` enabled.
 
 **VPN DNS auto-detection** is evaluated inside `proxy()` in DNS-intercept mode,
 after policy matching and independently of it, so it needs its own rule: