refresh_entry unconditionally queried the default upstream, so any
domain covered by a forwarding rule got re-resolved through the public
resolver once its cache entry hit NearExpiry or Stale. The resulting
NXDOMAIN/NODATA overwrote the good answer for at least cache.min_ttl
(60s default), persisting until restart. Match the precedence from
resolve_query: forwarding rule wins over recursive/default upstream.
Extract a_record_response() helper in testutil and migrate six call
sites — two regression tests here plus four adjacent tests using the
same boilerplate.
