Nameserver assessor: parent/child NS consistency (lame delegation)

Follow-up to #64 (part of #61).

The nameserver assessor was scoped to detect **parent/child NS-set consistency** (lame delegation: the child zone serves an NS the parent doesn't delegate, or vice-versa). This was deferred because of an infrastructure gap.

### The gap
gecko collects NS records via a **recursive** query against the configured resolver for the domain's own name (`ResolveDomainWorker`, `enumerate_jobs.go`), which yields the **child/authoritative** apex NS set. Detecting lame delegation requires *also* knowing the **parent's delegation** NS set, which means querying the parent (TLD) nameservers **non-recursively** — a capability the `dnsclient.Resolver` interface does not expose today.

### Scope
- Add a non-recursive "delegation lookup" to `internal/dnsclient` (query the parent zone's authoritative servers, read the NS RRset from the AUTHORITY section).
- Compare parent-delegated vs child-authoritative NS sets in the assessor; emit an `ns_configuration_findings` finding (e.g. `lame_delegation` / `parent_child_mismatch`) on divergence.

Start by reading internal/dnsclient and the dnsclient.Resolver interface, then trace how ResolveDomainWorker in enumerate_jobs.go obtains the child NS set. Add the parent delegation lookup and compare both NS sets in the nameserver assessor. Done means divergent parent and child sets emit an ns_configuration_findings finding such as lame_delegation or parent_child_mismatch.

Written by the indexing model from the issue text.