registry: DNS-style caching resolver with TTL, negative caching, and self-evicting agents

Description

The pitch.

## Summary

Adds `resolver`, a **DNS-style caching resolver** registry plugin: per-record TTL, negative-result caching, and self-eviction of stale/dead agents. The reference `in_memory` registry never expires records, so a crashed agent stays discoverable forever; the resolver models real service discovery where records go stale. Ships with an adversarial validator suite, a deterministic discovery scenario, docs, and tests.

## What and where — exact file manifest

**New plugin** — `packages/nest-plugins-reference/nest_plugins_reference/registry/caching_resolver.py` (186 lines)
- `CachingResolverRegistry` (**line 47**): registry with per-record TTL, negative caching (remembers "not found" for a bounded window), and stale eviction.
- `set_clock(now)` (**line 70**): pins the virtual clock the simulator advances. The clock defaults to `0.0` and `_now()` returns it directly — there is no `time.time()` fallback and no `time` import, so TTL expiry is driven only by `set_clock`. Records never expire until the clock is advanced, which keeps traces byte-identical under a fixed seed.
- `live_agents()` (**line 159**): the set of currently non-expired agents.

**Registration (2 lines)**
- `packages/nest-core/nest_core/plugins.py` — `("registry", "resolver")` builtin.
- `packages/nest-plugins-reference/pyproject.toml` — `nest.plugins.registry` entry point.

**Adversarial validators** — `packages/nest-plugins-reference/nest_plugins_reference/validators/resolver_validators.py`
- `check_stale_records_expire`, `check_heartbeat_keeps_alive`, `check_negative_cache_is_consistent`, and `run_all_resolver_checks`. Each **fails** against the reference `in_memory` registry (records never expire) and **passes** against the resolver. Exported from `validators/__init__.py`.

**Scenario**
- `packages/nest-core/nest_core/scenarios_builtin/discovery_resolver.py` + registration branch in `scenarios.py`.
- `scenarios/discovery_resolver.yaml`.

**Tests**
- `packages/nest-plugins-reference/tests/test_caching_resolver.py` — TTL expiry, negative caching, eviction, determinism.
- `packages/nest-plugins-reference/tests/test_discovery_resolver_scenario.py` — end-to-end scenario, deterministic across seeds.
- `packages/nest-plugins-reference/tests/test_resolver_benchmark.py` — the adversarial in_memory-fails / resolver-passes contrast.

## Maintainer review addressed

Removed the wall-clock fallback per review: `clock` now defaults to `0.0` (was `Optional[float] = None`), the `time` import is dropped, and `_now()` returns the pinned clock with no `time.time()` path. The plugin stays Tier-1 deterministic under any scenario selecting `registry: resolver`.

## Verification — full CI, branch merged with current `main`

`uv run ruff check .` clean · `uv run ruff format --check .` clean · `uv run pyright` strict **0 errors** · `uv run pytest` **999 passed**, 1 skipped.