netcheck: ask one named resolver, and list what listens here (hq issue 348)

During the 2026-10-09 outage the control node's resolver stayed active while it no longer listened on
its private address, and nothing on the mesh could ask that address a question or show which sockets
were bound. netcheck_dns takes server (and tcp) to ask one resolver alone and say its response code;
netcheck_listening reads the kernel's socket tables, as ss -lunt does, with the owning program where
the tool's account may see it and a sentence where it may not.

modules/netcheck/module.json

@@ -4,8 +4,20 @@
   "tools": [
     "netcheck_tcp",
     "netcheck_dns",
-    "netcheck_http"
+    "netcheck_http",
+    "netcheck_listening"
   ],
+  "replaces": {
+    "netcheck_listening": [
+      "ss -lunt",
+      "ss -ltn",
+      "netstat -lnt"
+    ],
+    "netcheck_dns": [
+      "dig",
+      "nslookup"
+    ]
+  },
   "build": {
     "artifacts": [
       {