warm the curated DNS resolver set so dead resolvers are cooled down

Random picks kept hitting unreachable public resolvers, costing a 2s timeout
on ~half of lookups and capping DNS throughput. Warm the default set at startup
(same health check used for the community list).

cmd/ctcloud/main.go

@@ -102,12 +102,14 @@ func run() error {
 	var resolver *dns.ServerPool
 	switch {
 	case len(dnsServers) == 0:
-		// Default: a curated set of reliable public resolvers. Deliberately not
-		// the community list by default: warming thousands of unknown resolvers
-		// at once has been observed to saturate and break the container's own
-		// resolver, taking down the CT log-list fetch.
+		// Default: a curated set of reliable public resolvers. Warm it too, so a
+		// resolver that is unreachable from this network is cooled down instead
+		// of costing a timeout on every random pick.
 		resolver = dns.NewServerPool(dns.CuratedServers())
-		slog.Info("dns resolvers configured", "count", resolver.Len(), "set", "curated")
+		warmCtx, cancel := context.WithTimeout(ctx, 8*time.Second)
+		healthy := resolver.Warm(warmCtx, "example.com", 16, 64)
+		cancel()
+		slog.Info("dns resolvers configured", "count", resolver.Len(), "healthy", healthy, "set", "curated")
 	case len(dnsServers) == 1 && dnsServers[0] == "fresh":
 		resolver = dns.NewServerPool(append(dns.CuratedServers(), dns.EmbeddedServers()...))
 		warmCtx, cancel := context.WithTimeout(ctx, 10*time.Second)