[codex] Tolerate partial quick tunnel DNS failures

[jianmosier]

What changed

• Allow the Quick Tunnel DNS delivery check to pass when a majority of configured public resolvers succeed instead of requiring every resolver to answer.
• Keep the direct public resolver checks, system resolver check, and public HTTPS route probe in place.
• Add focused tests for accepting majority DNS coverage and rejecting insufficient coverage.

Why

On this machine, direct DNS to 1.1.1.1 timed out repeatedly while Google DNS, AliDNS, DNSPod, 114DNS, the system resolver, and the public HTTPS route were all reachable. Requiring every configured resolver to succeed caused otherwise usable Quick Tunnel startup attempts to fail.

Validation

• npm run typecheck --workspace @codex-remote-iphone/bridge
• npm run test --workspace @codex-remote-iphone/bridge
• git diff --check
• Live npm run start -- --workspace /Users/jack/Code/zuanqian reached desktop-ipc mode and passed the public route check.