Integrate search-domain lifecycle with proxy DNS state

[thieso2]

Parent

#96

What to build

Integrate macOS search-domain lifecycle with proxy-backed DNS state. Search domains remain opt-in through the existing install/search commands, but state updates must not clobber proxy entries. Install should add the base suffix search domain only after proxy readiness and resolver write succeed. Uninstall should remove only Sandcastle-managed base suffix search domains for the uninstalled suffix and preserve project-specific search domains.

Acceptance criteria

• DNS install keeps search-domain installation opt-in.
• When requested, install adds the search domain only after proxy readiness and resolver file write succeed.
• Search-domain state updates preserve existing proxy state.
• Proxy install/uninstall state updates preserve existing search-domain state.
• Uninstall removes only Sandcastle-managed base suffix search domains for the target suffix.
• Uninstall preserves project-specific search domains managed by explicit search commands.
• Empty search service maps are cleaned up after removals.
• Tests cover successful install with search, failed install not adding search, state merge behavior, base suffix cleanup, project-specific preservation, and empty-map cleanup.

Blocked by

• Install a fresh proxy-backed macOS resolver #98
• Add offline-capable DNS uninstall for proxy-backed DNS #101