over-engineering audit: remove dead code, speculative config, duplicate queues

- delete embedded community resolver snapshot (6,760 lines) + EmbeddedServers +
  DNS_SERVERS=fresh; curated resolvers are the default. Simplify Warm (no
  sampling).
- one generic internal/sample.Queue[T] replaces three near-identical
  random-sample queues (probe, pipeline, discover).
- delete unreachable index.listOpenSearch (OpenSearch is never listable).
- delete classifyCloudFront (its match is always discarded, !ResourceSpecific).
- delete probe.Probe wrapper + Describe; tests use ProbeDetailed.
- delete store.Pool(), model.SourceDNSAlias, discover.QueueLen.
- drop dead config/no-op knobs: pipeline DirectWorkers, discover MaxPerDomain,
  discover S3/GCS/DO flags, BUCKET_SCAN_DO.
~-7,000 lines (mostly the resolver snapshot), 0 deps removed, tests green.

internal/dns/pool.go

@@ -2,7 +2,6 @@ package dns
 
 import (
 	"context"
-	_ "embed"
 	"errors"
 	mathrand "math/rand/v2"
 	"net"
@@ -12,30 +11,7 @@ import (
 	"time"
 )
 
-//go:embed resolvers.txt
-var embeddedResolvers string
-
-// EmbeddedServers returns the compiled-in public resolver list (a snapshot of
-// proabiral/Fresh-Resolvers). Refresh it with:
-//
-//	curl -sL https://raw.githubusercontent.com/proabiral/Fresh-Resolvers/master/resolvers.txt -o internal/dns/resolvers.txt
-//
-// These are untrusted third-party resolvers: they can observe and, in theory,
-// forge DNS answers. Use DNS_SERVERS with your own resolvers for sensitive
-// deployments. A circuit breaker skips ones that stop responding.
-func EmbeddedServers() []string {
-	lines := strings.Split(embeddedResolvers, "\n")
-	out := make([]string, 0, len(lines))
-	for _, l := range lines {
-		if l = strings.TrimSpace(l); l != "" {
-			out = append(out, l)
-		}
-	}
-	return out
-}
-
-// CuratedServers are well-known, reliable public resolvers. They are always
-// included (ahead of the community list) so a mostly-dead list still works.
+// CuratedServers are well-known, reliable public resolvers used by default.
 func CuratedServers() []string {
 	return []string{
 		"1.1.1.1", "1.0.0.1", // Cloudflare
@@ -118,28 +94,13 @@ func NewServerPool(servers []string) *ServerPool {
 // Len reports how many resolvers are in the pool.
 func (p *ServerPool) Len() int { return len(p.servers) }
 
-// Warm probes up to maxProbe randomly chosen resolvers and puts non-responders
-// into cooldown, so a large, partly-stale public list converges on a working
-// subset. It deliberately samples instead of probing the whole list: firing
-// thousands of concurrent DNS queries can overwhelm the host/container
-// resolver and break unrelated lookups. maxProbe <= 0 means all. Returns the
-// healthy count.
-func (p *ServerPool) Warm(ctx context.Context, probeHost string, workers, maxProbe int) int {
+// Warm probes every resolver and puts non-responders into cooldown, so the
+// pool starts on the working subset. Returns the healthy count.
+func (p *ServerPool) Warm(ctx context.Context, probeHost string, workers int) int {
 	if workers <= 0 {
 		workers = 32
 	}
 	servers := p.servers
-	if maxProbe > 0 && maxProbe < len(servers) {
-		order := make([]int, len(servers))
-		for i := range order {
-			order[i] = i
-		}
-		mathrand.Shuffle(len(order), func(i, j int) { order[i], order[j] = order[j], order[i] })
-		servers = make([]*server, maxProbe)
-		for i := range servers {
-			servers[i] = p.servers[order[i]]
-		}
-	}
 	probeTimeout := time.Second
 	if p.attemptTimeout > 0 && p.attemptTimeout < probeTimeout {
 		probeTimeout = p.attemptTimeout

internal/dns/pool_test.go

@@ -30,15 +30,6 @@ func (f *fakeLookup) LookupIP(ctx context.Context, host string) ([]net.IP, error
 	return []net.IP{net.ParseIP("1.2.3.4")}, nil
 }
 
-func TestEmbeddedServers(t *testing.T) {
-	if n := len(EmbeddedServers()); n < 1000 {
-		t.Fatalf("embedded resolver list has %d entries, want thousands", n)
-	}
-	if n := len(CuratedServers()); n < 10 {
-		t.Fatalf("curated resolver list has %d entries, want at least 10", n)
-	}
-}
-
 func TestServerCooldown(t *testing.T) {
 	s := &server{}
 	now := time.Now().UnixNano()
@@ -86,7 +77,7 @@ func TestWarmDisablesDeadResolvers(t *testing.T) {
 	dead := &fakeLookup{ipErr: &net.DNSError{Err: "timeout", IsTimeout: true}}
 	deadServer := &server{r: dead}
 	p := &ServerPool{servers: []*server{deadServer, {r: good}}}
-	healthy := p.Warm(context.Background(), "example.com", 4, 0)
+	healthy := p.Warm(context.Background(), "example.com", 4)
 	if healthy != 1 {
 		t.Fatalf("healthy = %d, want 1", healthy)
 	}