Prepare 1.3.3 recursion hotfix release

[drudge]

Prepare the 1.3.3 hotfix with curated release notes and updated handbook version metadata. Fix three failures in direct recursive resolution:

• Accept the root's sibling glue for .com nameservers under gtld-servers.net, avoiding delegation for com. has no resolvable name servers. Glue remains limited to named servers within the referring parent's scope.
• Route DS queries through the parent authority even when an earlier lookup cached the child's delegation, allowing DNSSEC validation to build the delegation chain correctly.
• Reserve time for each remaining authoritative server so retries against one silent server cannot exhaust the query deadline before a healthy alternative is contacted.

Validation:

• Reproduced all three failures before their respective fixes.
• Added coverage for root sibling glue, cold/warm DS lookups for TLD and child zones, failover with a silent first server, and signed DNSSEC validation through the iterative resolver with cached child delegations.
• go test -race ./internal/dnsserver -count=1 passes, including existing out-of-bailiwick glue rejection tests.
• Live cold- and warm-cache recursive lookups for cloudflare.com, ietf.org, and example.net returned DNSSEC-secure answers with a three-second resolution timeout. The network-dependent probe was run separately from the committed tests.
• git diff --check passes.

Release preparation: VERSION=1.3.3 go tool mage releaseGate passed: generated-code checks, Mage/application tests, static analysis, standalone and two-node cluster binary smoke tests, GoReleaser validation, all eight platform archives, and multi-architecture Docker snapshot builds with native container smoke checks. The first gate attempt hit the existing QUIC shutdown timing test; it passed ten isolated repetitions and the gate rerun. Release-note extraction for v1.3.3 succeeds. No release tag or publication has been created; after merging, dispatch the Release workflow from main with version 1.3.3.