Improve DNS resolver-chain and DoH policy gates

[vibefounder]

Closes #2366

Summary

• add resolver-chain evidence requirements before classifying DNS forwarding as plaintext
• add effective DoH policy checks across browser, endpoint, firewall, and resolver controls
• add local encrypted DNS proxy examples and a false-positive pitfall
• bump dns-security skill version to 1.0.1

Validation

• git diff --check

[github-actions]

Thanks for the submission! 🙏 SecuritySkills is now issue-first: contributions need a linked issue that a maintainer has marked approved before a PR is opened.

Please open an issue describing the skill, wait for the approved label, then reopen this PR with Closes #<issue> in the description. The PR template lists everything we'll look for (including an independently runnable reproduction).