add auto-detect upstream, install script, release workflow

- Default upstream auto-detected from system resolver (scutil/resolv.conf)
  instead of hardcoding Google 8.8.8.8. Falls back to Quad9 (9.9.9.9).
- Single scutil --dns pass for both upstream detection and forwarding rules
- Linux: reads backup resolv.conf if current only has loopback
- Service start/stop now couples DNS config (install on start, uninstall on stop)
- Install script for one-line binary install from GitHub Releases
- GitHub Actions release workflow: builds for macOS/Linux x86_64/aarch64

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/packet.rs

@@ -70,7 +70,11 @@ impl DnsPacket {
     pub fn write(&self, buffer: &mut BytePacketBuffer) -> Result<()> {
         // Filter out UNKNOWN records (e.g. EDNS OPT) that we can't re-serialize
         let answers: Vec<_> = self.answers.iter().filter(|r| !r.is_unknown()).collect();
-        let authorities: Vec<_> = self.authorities.iter().filter(|r| !r.is_unknown()).collect();
+        let authorities: Vec<_> = self
+            .authorities
+            .iter()
+            .filter(|r| !r.is_unknown())
+            .collect();
         let resources: Vec<_> = self.resources.iter().filter(|r| !r.is_unknown()).collect();
 
         let mut header = self.header.clone();