Enforce timeout for system DNS resolution

[ryanfowler]

Summary

• enforce the supplied TimeoutBudget around the system lookup_host branch of resolve_host_with_doh_tls
• ensure a stalled system resolver cannot exceed --connect-timeout
• retain caller-level outer timeouts as defense in depth
• keep DoH and custom DNS on their existing internal timeout budgets
• add a boxed, injectable system resolver future for deterministic timeout testing without growing the request future stack

Root cause

The system-resolver branch awaited tokio::net::lookup_host directly, even though resolve_host_with_doh_tls received a timeout budget. Callers such as explicit HTTP/3 setup and QUIC TLS inspection await this resolver directly, allowing a stalled system resolver to run beyond the configured connect timeout.

An initial implementation wrapped the complete resolver state machine in TimeoutBudget::run. That enlarged the stack-resident request future enough to overflow the default-sized fetch-main runtime thread in several network integration tests. The corrected implementation wraps only a boxed system lookup future, leaving the larger DoH/custom resolver paths unchanged.

Impact

System DNS resolution now terminates with the normal request timeout diagnostic when it stalls. Explicit HTTP/3 connections and QUIC TLS inspection honor the configured connect timeout without increasing request stack usage.

Validation

• cargo fmt --check
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --locked --all-features --lib --bins (872 passed)
• full CI-equivalent integration suite with --test-threads=2
• cargo test --locked --all-features --test network -- --test-threads=2 (27 passed)
• deterministic focused test with a permanently pending injected resolver
• locally reproduced the prior stack overflow, then verified the failing HTTP/3 cache case passes after the fix