fix panic: cached NXDOMAIN returned an empty CNAME chain as success

ResolveCNAME/ResolveIPs cached negative results as an empty Result but the
cache-hit path returned (empty, true), so enrichHost did chain[1:] on a
zero-length slice and the process panicked (exit 2). Negative cache hits now
return false, plus a defensive length guard in enrichHost and a regression test.

internal/pipeline/pipeline.go

@@ -266,7 +266,7 @@ func (p *Pipeline) enrichHost(ctx context.Context, host string) {
 	// CNAME-only during enrichment: this is the high-volume path and A/AAAA is
 	// not needed to classify the target. IPs are resolved only for matches.
 	chain, ok := p.cfg.Enricher.ResolveCNAME(ctx, host)
-	if !ok {
+	if !ok || len(chain) < 2 {
 		return
 	}
 	for _, target := range chain[1:] {