feat(ednsdiag): add DoQ/DoH3/DNSCrypt transports, proxy support, probe & compare

.agents/skills/encrypted-dns-skill/SKILL.md

@@ -9,7 +9,7 @@ Use `ednsdiag` for encrypted DNS work. Do not assemble protocol requests with
 `curl`, `openssl`, or ad-hoc scripts when `ednsdiag` supports the operation.
 The executable requires network access.
 
-Prefer an installed `ednsdiag` executable. When it is unavailable and Go 1.26+
+Prefer an installed `ednsdiag` executable. When it is unavailable and Go 1.26.6+
 is installed, run the source from the skill root with:
 
 ```bash
@@ -35,14 +35,27 @@ Only use a protocol when its reported status is `available`. Never describe a
 ```bash
 ednsdiag query example.com A --protocol doh --provider cloudflare
 ednsdiag query gmail.com MX --protocol dot --provider google --timeout 5s
+ednsdiag query example.com AAAA --protocol doq --provider adguard
+ednsdiag query example.com HTTPS --protocol doh3 --provider cloudflare
+ednsdiag query example.com A --protocol dnscrypt --provider adguard
+ednsdiag probe example.com A --protocol dot --provider cloudflare
+ednsdiag compare example.com A --target doh:cloudflare --target dot:google
 ednsdiag capabilities
 ednsdiag version
 ```
 
-Use `--method get` or `--method post` only with DoH. The default is POST.
+Use `--method get` or `--method post` only with DoH or DoH3. The default is POST.
 Built-in providers are `cloudflare`, `google`, `quad9`, and `adguard`. Provider
-filtering policies differ and are included in the result. `probe` and `compare`
-remain reserved until their capabilities are implemented.
+protocol support and filtering policies differ and are included in the result.
+Run `capabilities` and do not infer an unsupported endpoint. `probe` executes
+one diagnostic query while labeling the operation for automation. `compare`
+requires two or more explicit `protocol:provider[:method]` targets and preserves
+each result independently.
+
+For a user-requested HTTP(S) proxy, pass `--proxy http://host:port`. Without
+that flag, DoH and DoT honor `HTTPS_PROXY` and `NO_PROXY`. Only DoH and DoT can
+use this CONNECT proxy; do not add `--proxy` to DoH3, DoQ, or DNSCrypt commands.
+Never expose proxy credentials when quoting a command or interpreting output.
 
 ## Required behavior
 
@@ -65,7 +78,16 @@ remain reserved until their capabilities are implemented.
 - Read `transport.server_authenticated` separately from DNSSEC fields.
 - Read `transport.bootstrap`; `system_resolver` means resolving the encrypted
   resolver endpoint itself used the operating system resolver.
+- If `transport.proxy` is present, the exchange used that sanitized proxy
+  endpoint; credentials are deliberately omitted.
+- For DNSCrypt, `stamp_ip` means the authenticated resolver stamp supplied the
+  connection address; verify `resolver.authentication_name` and certificate
+  metadata in the result.
 - Empty answers with `NOERROR` represent NODATA.
+- Treat truncated or non-representable answers as protocol failures; never
+  infer a partial result from an incomplete exchange.
+- For DoH and DoH3, `transport.http_age_seconds` is already subtracted from
+  answer TTLs when an HTTP cache reports an age.
 - A filtering resolver may synthesize `NXDOMAIN`; disclose the provider.
 
 ## References
@@ -78,6 +100,8 @@ remain reserved until their capabilities are implemented.
   modifying a built-in provider.
 - Keep output compatible with
   [schemas/result-v1.schema.json](schemas/result-v1.schema.json).
+- Read [references/contracts.md](references/contracts.md) when integrating the
+  CLI with an agent or changing command, exit-code, or JSON behavior.
 
 ## Scope