V3 bounded DNS diagnostics capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local dig CLI ingredient exposes fixed operations for readiness plus common DNS lookups: A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, and reverse PTR. DNS lookup operations require approval because they send caller-supplied names or addresses through the executor's local dig resolver selection and can reveal the executor network path. The pack uses short output, one lookup name/address per invocation, fixed timeout and retry caps, explicit command-line overrides for trace, nssearch, search-list, TCP, and responder-identification defaults, and no caller-supplied resolver, query class, arbitrary record type, trace, zone transfer, batch file or config file, environment override, stdin, output-file write, or shell wrapper. Requires dig on PATH, commonly provided by BIND utilities.