fix(mdns): retain origin and bound daemon state

Vendor the pinned mdns-sd 0.21.1 source so response records retain their observed source IP. Bound unauthenticated cache records to 1024 globally and 128 per source, deduplicate and cap timers at 4096, and poll at least once per second for expiry cleanup.

Expose packet provenance through lanspread-mdns, drop originless resolutions, and add a dedicated vendor test recipe while keeping third-party sources outside workspace formatting and Clippy.

Test Plan:
- just mdns-vendor-test (106 tests passed with socket access)
- just test
- just fmt
- just clippy
- cache/per-source, exact-refresh, timer-cap, and serde tests
- git diff --check

vendor/mdns-sd/LANSPREAD_PATCH.md

@@ -0,0 +1,18 @@
+# Lanspread mdns-sd patch
+
+This directory vendors `mdns-sd` 0.21.1 under its original MIT/Apache-2.0
+license. Lanspread carries a narrow defensive patch because the upstream API
+does not expose the source address of resolved service responses and its cache
+and timer collections have no hard admission limits.
+
+The local changes:
+
+- retain the observed source IP with cached records and expose the source of a
+  resolved service;
+- cap cached records at 1,024 globally and 128 per observed source;
+- cap and deduplicate daemon timers at 4,096 entries; and
+- wake the daemon at least once per second so dropped late timers cannot defer
+  expiry cleanup indefinitely.
+
+Keep this directory at the exact version recorded in `Cargo.lock`. Rebase the
+patch explicitly when updating the upstream crate.