feat(ednsdiag): add DoQ/DoH3/DNSCrypt transports, proxy support, probe & compare

.agents/skills/encrypted-dns-skill/references/security.md

@@ -8,7 +8,7 @@ validation, fallback, or result claims.
 1. Never silently downgrade to plaintext DNS.
 2. Validate certificates and authentication domain names. DoT follows the
    strict privacy profile in [RFC 8310](https://www.rfc-editor.org/rfc/rfc8310.html).
-3. Treat certificate, hostname, SNI, and negotiated ALPN mismatches as hard
+3. Treat certificate, hostname, SNI, and any non-empty negotiated ALPN mismatch as hard
    failures, not fallback opportunities.
 4. Bound response sizes, per-attempt timeouts, total time, redirects, and the
    number of attempts.
@@ -19,12 +19,62 @@ validation, fallback, or result claims.
 7. Do not enable AXFR, IXFR, or ANY queries.
 8. Do not persist full query names or client identifiers by default.
 
+## Proxy policy
+
+DoH and DoT may use an explicit `--proxy` or the standard Go
+[`ProxyFromEnvironment`](https://pkg.go.dev/net/http#ProxyFromEnvironment)
+selection rules for `HTTPS_PROXY` and `NO_PROXY`. An explicit URL takes
+precedence and must use `http` or `https`. DoT establishes an HTTP CONNECT
+tunnel and then performs the normal resolver TLS handshake inside it; the
+proxy never substitutes for resolver certificate, authentication-domain, SNI,
+or ALPN validation.
+
+Proxy credentials may be sent as HTTP Basic authentication when embedded in
+the URL, but must never appear in result JSON or diagnostic errors. Result
+metadata contains only a sanitized proxy endpoint. An HTTP(S) proxy can observe
+the resolver destination, connection timing, and traffic volume even though it
+cannot read the resolver TLS payload.
+
+DoH3, DoQ, and the current DNSCrypt transport use UDP or QUIC and do not use a
+TCP HTTP CONNECT proxy. Reject an explicit proxy for those protocols instead of
+silently connecting directly. Proxy failures are transport failures and never
+trigger plaintext DNS or an undisclosed direct connection.
+
 ## DoT ALPN policy
 
-The client advertises the `dot` ALPN identifier. RFC 7858 and RFC 8310 do not
-require a DoT server on its dedicated port to select an ALPN protocol, so an
-empty negotiated ALPN is permitted and reported as empty. If a server selects
-a non-empty protocol other than `dot`, abort before sending the DNS query.
+The client advertises the IANA-registered `dot` ALPN identifier. An explicit
+selection other than `dot` is a hard failure before the DNS query is sent. An
+empty selection is permitted and reported because RFC 7858 and RFC 8310 do not
+make ALPN negotiation part of DoT server authentication; the dedicated port,
+PKIX chain, SNI, and configured authentication domain still identify the
+service. This deliberately restores the policy from PR #9 and supersedes the
+stricter empty-ALPN rejection introduced by PR #11.
+
+## QUIC transport policy
+
+DoQ requires TLS 1.3 and an exact `doq` ALPN selection. DoH3 requires TLS 1.3,
+HTTP/3, and an exact `h3` ALPN selection. Certificate, authentication-domain,
+SNI, and ALPN failures abort before a DNS query is sent. The initial
+implementation does not send 0-RTT data or enable session resumption because
+their replay and linkability properties require a separate policy decision.
+
+Each DoQ query uses one client-initiated bidirectional stream, a two-octet
+length prefix, DNS Message ID 0, and STREAM FIN. Truncated frames, extra
+responses, non-zero response IDs, unexpected streams, and missing FIN are
+protocol failures; they never trigger plaintext or cross-protocol fallback.
+
+Reject DNS messages with the TC bit set on every encrypted transport. In
+particular, the UDP-only DNSCrypt implementation must not expose a partial
+answer as a completed lookup.
+
+## DNSCrypt transport policy
+
+Accept only allowlisted DNSCrypt v2 stamps. Validate the stamp type, provider
+public key, provider name, resolver certificate signature, validity interval,
+and encrypted response. Report the stamp IP bootstrap path, provider
+authentication name, certificate serial, and crypto construction. Certificate
+or response-authentication failures are hard failures and never trigger
+plaintext or cross-protocol fallback. Anonymized DNSCrypt remains unavailable.
 
 ## Bootstrap transparency