…C 9989 S 4.10)

dmarc_dns_get_record() previously returned the first "v=DMARC" TXT record
found without checking for duplicates, silently violating the rule in both
RFCs that multiple valid DMARC records at a single DNS name must all be
discarded.

- Scan all TXT records in the answer before returning; count those
  containing "v=DMARC".  Return the record only when exactly one is found;
  return NULL/NO_DATA when zero or more than one are found.
- Fix the fake DNS table path with the same count-before-returning logic.
- Fix a pre-existing cursor advancement bug: the non-DMARC TXT branch was
  adding the already-consumed dn_expand name length a second time.  Replace
  ad-hoc cur_ptr arithmetic with an rdata_end pointer set from RDLENGTH.
- Add a fake-DNS test case: two v=DMARC1 entries for the same name must
  yield DMARC_DNS_ERROR_NO_RECORD.

…survey

For every rua= and ruf= URI whose destination domain differs from the
policy domain, query {policy-domain}._report._dmarc.{dest-domain} and
flag any that lack a v=DMARC1 consent record.

- New output columns rua_bad / ruf_bad: comma-separated list of external
  URIs missing consent, or "-" if none problematic
- Async consent-check phase after the main DNS loop, at full concurrency
- Same-domain and subdomain URIs skipped (no check needed)
- Output buffered until consent phase completes; then written in one pass
- Summary log gains rua_ext_bad / ruf_ext_bad columns for trend tracking

Casts strdup() results back to u_char * for organizational_domain
assignments in query_dmarc_psl, query_dmarc_rfc7489_walk, and
query_dmarc_rfc9989_walk, matching the cast convention applied
elsewhere in trusteddomainproject#426.

Documents that AUTO mode's fallback to the RFC 7489 walk applies
whenever the PSL path fails, not only when no PSL boundary was found,
which is a deliberate broadening versus pre-refactor behavior.