Answer the review of hq issue 348's catalogue change

- The dnsmasq watch restarts only a unit that runs, without waiting for
  its start; a unit stopped, starting or failed is held and said (C2).
- dnsmasq_resolve asks only an address the resolver listens on (C3).
- Tests for the watch loop keeping its budget, a watch that wrote nothing
  or stopped looking, and a unit not running (C4).
- A restart is remembered as said only once emitted, restarts made before
  the bundle started are said, and whether one helped is said (C5).
- docker_events reads the runtime's whole buffer: complete when it is not
  full or reaches past the window, never a quiet machine read as lost (C6).
- netcheck: refused read with errors.Is; tests for addresses and ports,
  and for a container named as docker knows it.

modules/docker/cmd/docker-tools/resolv_test.go

@@ -81,3 +81,16 @@ func TestAResolverFileThatCannotBeReadIsSaidPlainly(t *testing.T) {
 		t.Fatalf("an unreadable machine file: %v, %v", got, err)
 	}
 }
+
+// The container is named as docker knows it, never as something docker would read as an option.
+func TestAResolverFileIsAskedOnlyOfAContainerRef(t *testing.T) {
+	f := &fake{}
+	for _, ref := range []string{"--privileged", "a b", "", "x;rm"} {
+		if _, err := client(f, 1000).ResolvConfOf(context.Background(), ref); err == nil {
+			t.Errorf("%q was asked of the runtime", ref)
+		}
+	}
+	if len(f.calls) != 0 {
+		t.Fatalf("the runtime was asked: %+v", f.calls)
+	}
+}