fix panic: cached NXDOMAIN returned an empty CNAME chain as success

ResolveCNAME/ResolveIPs cached negative results as an empty Result but the
cache-hit path returned (empty, true), so enrichHost did chain[1:] on a
zero-length slice and the process panicked (exit 2). Negative cache hits now
return false, plus a defensive length guard in enrichHost and a regression test.

internal/dns/resolver.go

@@ -100,6 +100,11 @@ func (e *Enricher) ResolveCNAME(ctx context.Context, host string) ([]string, boo
 	key := "c:" + host
 	if e.Cache != nil {
 		if res, ok := e.Cache.Get(key); ok {
+			if len(res.Chain) == 0 {
+				// Negatively cached: remember the failure, do not report a
+				// (empty) successful chain to callers.
+				return nil, false
+			}
 			if e.Metrics != nil {
 				e.Metrics.DNSCacheHits.Add(1)
 			}
@@ -135,6 +140,9 @@ func (e *Enricher) ResolveIPs(ctx context.Context, host string) ([]net.IP, bool)
 	key := "ip:" + host
 	if e.Cache != nil {
 		if res, ok := e.Cache.Get(key); ok {
+			if len(res.IPs) == 0 {
+				return nil, false // negatively cached
+			}
 			if e.Metrics != nil {
 				e.Metrics.DNSCacheHits.Add(1)
 			}