fix(dns): make marked-client Control assertions platform-specific

Review (goal verification) found that socket_test.go asserted
Dialer.Control != nil without build tags, so 'go test ./core/dns/'
fails on Windows where markedDialer() deliberately omits Control
(SO_MARK is a Linux-only option; markFd is a no-op there).

Move the Control assertions to socket_unix_test.go (//go:build !windows);
socket_test.go keeps the platform-neutral assertions (Net/UDPSize/timeouts/
Dialer non-nil). Verified: Linux go build + go test all pass, and
GOOS=windows go vet compiles the test files cleanly.

core/dns/socket_test.go

@@ -25,9 +25,6 @@ func TestNewMarkedDnsClient(t *testing.T) {
 	if client.Dialer == nil {
 		t.Fatal("Dialer is nil")
 	}
-	if client.Dialer.Control == nil {
-		t.Error("Dialer.Control is nil — sockets would not carry SO_MARK=0x80 and queries could loop back into the DNS module")
-	}
 }
 
 func TestNewMarkedDnsClientTCP(t *testing.T) {
@@ -38,7 +35,4 @@ func TestNewMarkedDnsClientTCP(t *testing.T) {
 	if client.Dialer == nil {
 		t.Fatal("Dialer is nil")
 	}
-	if client.Dialer.Control == nil {
-		t.Error("Dialer.Control is nil — TCP sockets would not carry SO_MARK=0x80")
-	}
 }

core/dns/socket_unix_test.go

@@ -0,0 +1,31 @@
+//go:build !windows
+
+package dns
+
+import (
+	"testing"
+)
+
+// On Unix, markedDialer() sets Dialer.Control so every socket created by the
+// dialer carries SO_MARK=0x80 (the fwmark that makes iptables skip the DNS
+// redirect rules). Without Control the upstream queries would be hijacked
+// back into this module — an infinite loop and unbounded memory growth.
+// Windows has no SO_MARK (markFd is a no-op there), so these assertions are
+// platform-specific and live in a !windows file.
+func TestMarkedDnsClientHasControl(t *testing.T) {
+	udpClient := newMarkedDnsClient("udp")
+	if udpClient.Dialer == nil {
+		t.Fatal("Dialer is nil")
+	}
+	if udpClient.Dialer.Control == nil {
+		t.Error("Dialer.Control is nil — UDP sockets would not carry SO_MARK=0x80 and queries could loop back into the DNS module")
+	}
+
+	tcpClient := newMarkedDnsClient("tcp")
+	if tcpClient.Dialer == nil {
+		t.Fatal("Dialer is nil")
+	}
+	if tcpClient.Dialer.Control == nil {
+		t.Error("Dialer.Control is nil — TCP sockets would not carry SO_MARK=0x80")
+	}
+}