feat(rdns): network-scoped rDNS eviction with generation-guarded inflight lookups

[dweekly]

Summary

Implements phase 2 of Cache and Network-Transition Lifecycle from docs/CACHE-AND-TRANSITION-LIFECYCLE.md:

• invalidateNetworkScopedRDNS(): Selectively evicts cached reverse DNS entries whose address is not globally routable (RFC 1918 private, CGNAT, link-local, loopback, IPv6 ULA). Globally routable internet hostnames and their TTLs are preserved.
• Scope-aware generation tracking: Replaces the single cache generation in RDNSCache with scopedGeneration and globalGeneration. When invalidateNetworkScoped() is called, in-flight scoped lookups are discarded, while in-flight global lookups complete and cache normally. Full clear() continues to invalidate both.
• Stall breaker reset: Calling invalidateNetworkScopedRDNS() resets consecutiveStalls so subsequent lookups are immediately attempted on the new network path.

Stacked on top of #79 (feat/trace-options-and-cancellation).

Testing

• Unit tests in CacheGenerationTests.swift:
  • scopedEvictionPreservesGlobal: Verifies scoped entries (RFC 1918, CGNAT, link-local, loopback, ULA) are evicted while global IPv4/IPv6 entries remain cached with unchanged hit counts.
  • scopedEvictionResetsStallBreaker: Verifies that tripped circuit breaker is reopened on scoped eviction.
  • inFlightScopedVsGlobal: Verifies that an in-flight scoped lookup is rejected while an in-flight global lookup completes and caches.
  • tracerScopedEviction: Verifies actor-level invocation.
• All tests pass; docc builds cleanly with --warnings-as-errors; formatting checked with swift format lint --strict.