What review found in the lab, fixed

A segment named "uplink" is refused. The lab claims that name for the
NAT bridge behind `egress: true`, and a scenario wearing it first would
have its egress machines silently attached to an isolated bridge — a
declared key doing nothing, which is the fault this repo exists to
refuse, in the repo that refuses it.

settled() parses inside the try. A truncated status from a struggling
machine was the one shape of bad answer that still threw out of the
wait, and the likeliest moment for one is exactly the machine the poll
is watching. Malformed now counts as "could not ask", like the exec
that times out.

And a sentence on the uplink's UseDNS saying its inertness is
load-bearing: it matters only where systemd-resolved runs, and on a
machine whose modules own resolv.conf the uplink must not outvote the
resolver a scenario is testing.

src/lifecycle/address.ts

@@ -50,6 +50,9 @@ function networkUnit(wire: Wire): string {
       "IPv6AcceptRA=no",
       "",
       "[DHCPv4]",
+      // UseDNS matters only where systemd-resolved runs; on a machine whose mesh modules own
+      // /etc/resolv.conf it is inert, and that inertness is load-bearing — the uplink must not
+      // outvote the resolver a scenario is testing.
       // **Worse than any route the scenario states.** A machine behind a declared gateway must
       // keep using it: the uplink is a way out of the scenario, not a better way around inside
       // it. On-link segments win regardless, being connected routes; this only settles which