Print why the resolver did not start, instead of that it did not

`systemctl is-active` exits non-zero for a unit that failed, so `must` threw
before the assertion carrying every diagnostic — and the run said only
"failed". The journal, the config, what the mesh wrote and resolv.conf are all
things the next run should not have to be re-run to see.

test/integration/mesh.test.ts

@@ -1392,10 +1392,18 @@ test("a service is reached by a name under the machine it runs on", {
   await mesh("push");
   await new Promise((r) => setTimeout(r, 25_000));
 
+  // `on`, not `must`: `is-active` exits non-zero for a unit that failed, so `must` would throw
+  // before the assertion below — taking every diagnostic with it. That happened, and the run said
+  // only "failed".
   for (const machine of ["anchor", "laptop"]) {
-    assert.match(await must(machine, `systemctl is-active dnsmasq.service`), /^active/,
+    const state = await on(machine, `systemctl is-active dnsmasq.service`);
-      `the resolver is not running on ${machine}:\n` +
+    if (state.out.trim() === "active") continue;
-      `${(await on(machine, `journalctl -u dnsmasq -n 20 --no-pager`)).out}`);
+    assert.fail(
+      `the resolver is not running on ${machine} (${state.out.trim()}):\n\n` +
+      `journal:\n${(await on(machine, `journalctl -u dnsmasq -n 25 --no-pager`)).out}\n` +
+      `its config:\n${(await on(machine, `cat /etc/dnsmasq.conf`)).out}\n` +
+      `what the mesh wrote:\n${(await on(machine, `cat /etc/mesh-resolver/nodes.conf`)).out}\n` +
+      `resolv.conf:\n${(await on(machine, `cat /etc/resolv.conf`)).out}`);
   }
 
   // Through the machine's own resolver, by the path an application actually takes: nsswitch, then