dnsmasq: ask the resolver a real question, and restart it when it stops answering (hq issue 348)

On 2026-10-09 the control node's dnsmasq stayed active and running, its
journal silent, and refused every question on its private address for
twenty minutes; nothing in the module looked past the unit.

The module is now Go (its TypeScript tools were never served): a root
watch asks the machine's own name on every listen address over UDP and
TCP every 15s, restarts the unit after two failing looks (2 min apart,
3 an hour), and says whether that helped. dnsmasq_health is the watch
process's declared check, so a restart that did not help becomes the
module's unhealthy condition; the service is judged by its unit.

modules/dnsmasq/module.json

@@ -17,7 +17,8 @@
   ],
   "emits": [
     "name.added",
-    "name.removed"
+    "name.removed",
+    "restarted"
   ],
   "own-secrets": {
     "broker": "${dir:mesh-state}/broker"
@@ -28,6 +29,11 @@
       "scope": "mesh"
     }
   ],
+  "tools": [
+    "dnsmasq_health",
+    "dnsmasq_names",
+    "dnsmasq_resolve"
+  ],
   "listens": [
     {
       "name": "dns-udp",
@@ -75,7 +81,34 @@
         "config",
         "dnsmasq.fact-node-zones",
         "dnsmasq.fact-zones"
-      ]
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "watch-dir",
+      "type": "directory",
+      "path": "/var/lib/dnsmasq-watch",
+      "mode": "0755"
+    },
+    {
+      "id": "watch",
+      "type": "process",
+      "name": "dnsmasq-watch",
+      "artifact": "tools",
+      "run": [
+        "./dnsmasq-tools",
+        "watch"
+      ],
+      "health": {
+        "kind": "tool",
+        "tool": "dnsmasq_health",
+        "interval": "20s",
+        "timeout": "10s",
+        "looks": 2,
+        "grace": "60s"
+      }
     }
   ],
   "facts": {
@@ -87,5 +120,20 @@
       "path": "/etc/mesh-resolver/zones.conf",
       "template": "# Generated by the mesh. Do not edit — this file is replaced whenever a module declares a zone or\n# its machine moves (novox/hq ADR 0199). One forwarding line per zone, to the module answering it.\n\n{{range .Zones}}server=/{{.Zone}}/{{.Address}}#{{.Port}}\n{{end}}"
     }
+  },
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/dnsmasq-tools",
+        "binary": "dnsmasq-tools",
+        "loads": [
+          "dnsmasq-tools"
+        ]
+      }
+    ]
   }
 }