fix: add DNS resilience for BuildKit containers

[devin-ai-integration]

Summary

Addresses recurring EAI_AGAIN / ETIMEDOUT failures during Docker builds when BuildKit containers can't resolve npm/Docker registry hostnames through the sole systemd-resolved nameserver. Observed ~103 Docker - Build API failures for naboo-team in the last 30 days (eu-west ARM runners), all caused by transient DNS resolution failures inside BuildKit containers.

Two changes:

1. DNS health-check after systemd-resolved restart — waitForDnsReady() polls getent hosts against registry.npmjs.org + registry-1.docker.io with 500ms intervals up to 10s, ensuring the resolver is responsive before BuildKit starts issuing queries.

2. Add a public DNS fallback to BuildKit's nameserver config — getRoutableHostDns() now returns [hostIp, "8.8.8.8"] instead of [hostIp]. BuildKit round-robins across nameservers (not ordered fallback), so ~50% of queries still hit the local systemd-resolved cache while the other 50% go direct to Google DNS. This is a deliberate trade-off: we lose some cache efficiency but gain resilience when systemd-resolved is transiently unavailable.

- return [hostIp];              // single point of failure
+ return [hostIp, "8.8.8.8"];   // local cache + public fallback

Link to Devin session: https://app.devin.ai/sessions/6d41a8230c874dcaa490df945caa2315

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled. (Staging)}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[pbardea]

This reverts to behavior that we saw in #63 which actually reduced the amount of these DNS errors.