feat(react): show what a failing DNS check expected and observed (#94)

## Summary

A failing DNS check told a customer only that it failed. It now says
what the requirement asks for
and what each observer actually read back for that name.

```
CNAME app.example.com                    ⊗ Different value
Expected edge.example.com
FAKE RECORDS
Found old.example.com
PUBLIC DNS VIA CLOUDFLARE
Found old.example.com, older.example.com
The name resolves somewhere else.
PUBLIC DNS VIA GOOGLE
Found nothing
```

## What renders

| Line | Source | When |
| --- | --- | --- |
| Expected value | `DnsRecord.data(requirement.record)` | the
requirement is not `satisfied` |
| Observed values | `evidence.values`, per observer | the requirement is
not `satisfied`, and the observer answered |
| Detail | `evidence.detail` | the observer supplied one |

Host evidence reports a status the host reached rather than values read
off a name, so it carries
no observed line. Neither does an observer whose own status is
`unknown`: it never answered, which
is not the same as finding nothing, so `missing` stays the one status
that reports an empty name. A
satisfied requirement stays quiet: no expected line, no observed line.

## Catalog

Three keys join `Messages.Catalog`, so the only observer text that
reaches a customer is the
`detail` the observer wrote:

```ts
expectedValue: (value) => `Expected ${value}`,
observedValues: (values) => `Found ${values.join(", ")}`,
observedNothing: "Found nothing",
```

## Screenshots

![Evidence for a mismatched
requirement](https://github.com/user-attachments/assets/c4d5aeca-a58a-4042-b5b9-f71ef6e89712)

## Tests

- `tests/verification-evidence.test.tsx` builds a readiness from the
wire constructors
(`Verify.ProviderEvidence`, `Verify.PublicDnsEvidence`,
`Verify.HostEvidence`) and asserts the
expected line, the per-observer values, the empty case, the detail
lines, and that a satisfied
  requirement gets none of them. Removing either branch fails it.
- `tests/browser/flow.spec.ts` renders the same panel in Chrome through
a fixture view, because the
fake transport reaches every state except a requirement that resolves
somewhere else.

`bun run --filter @domainkit/react release:check` and the root
`release:check` are green.