Answer the review of hq issue 348's catalogue change

- The dnsmasq watch restarts only a unit that runs, without waiting for
  its start; a unit stopped, starting or failed is held and said (C2).
- dnsmasq_resolve asks only an address the resolver listens on (C3).
- Tests for the watch loop keeping its budget, a watch that wrote nothing
  or stopped looking, and a unit not running (C4).
- A restart is remembered as said only once emitted, restarts made before
  the bundle started are said, and whether one helped is said (C5).
- docker_events reads the runtime's whole buffer: complete when it is not
  full or reaches past the window, never a quiet machine read as lost (C6).
- netcheck: refused read with errors.Is; tests for addresses and ports,
  and for a container named as docker knows it.

modules/netcheck/cmd/netcheck/checks.go

@@ -9,6 +9,7 @@ import (
 	"sort"
 	"strconv"
 	"strings"
+	"syscall"
 	"time"
 )
 
@@ -220,7 +221,7 @@ func timeoutOf(args map[string]any) (time.Duration, error) {
 func dnsWords(err error, timeout time.Duration) string {
 	var ne net.Error
 	switch {
-	case strings.Contains(err.Error(), "connection refused"):
+	case errors.Is(err, syscall.ECONNREFUSED):
 		return "connection refused: nothing listens on that address and port"
 	case errors.As(err, &ne) && ne.Timeout():
 		return fmt.Sprintf("no answer within %s", timeout)