perf: revisit DNS proxy scaling and tail latency

## Summary

Non-blocking performance follow-up for DNS proxy scaling. This is not a 1.3 release blocker: the per-query vsock churn was fixed in `7147af36` and DNS is now fast enough, but the curve still does not scale cleanly at higher concurrency.

## Current benchmark

Run from `release/1.3-cleanup-pr-v2` against the hermetic bogus TLD path (`load-test.capsem-bogus`) after the persistent DNS vsock-session fix.

| concurrency | rps | p50 | p95 | p99 | errors |
|---:|---:|---:|---:|---:|---:|
| 1 | 2611.9 | 0.4ms | 0.4ms | 0.7ms | 0 |
| 10 | 12391.2 | 0.7ms | 1.1ms | 1.3ms | 0 |
| 50 | 13141.6 | 2.7ms | 5.5ms | 7.1ms | 0 |
| 200 | 13073.3 | 12.4ms | 31.4ms | 36.7ms | 0 |

## Why revisit

Throughput improved dramatically versus the old per-query connection path, but c=50/c=200 mostly plateau and tail latency grows. We should push this later so DNS stays boring under agent-heavy workloads.

## Guardrails

- Preserve the security/logging rail: no DNS response should bypass the security event path.
- Keep the benchmark hermetic: no external resolver dependency for the release gate.
- Do not add route/projection caches; optimization belongs in the network/DB-owned paths.
- Track worker count, queueing, DB write pressure, and p95/p99 latency while tuning.

No source files or tests are named. Start by rerunning the benchmark on release/1.3-cleanup-pr-v2 against load-test.capsem-bogus, then inspect the network and DB-owned paths while tracking worker count, queueing, DB write pressure, and p95/p99 latency. Done means better high-concurrency scaling without bypassing the security event path, adding route/projection caches, or requiring an external resolver.

Written by the indexing model from the issue text.