Move the "skip DNSKEY when no parent DS" decision out of Collect and
into the rules, so the prober stays a pure observer. The dnskeyQueryRule
and dnskeyMatchesDSRule already return StatusUnknown when no parent DS
is present.
The binary doubles as its own healthcheck client via the SDK's
-healthcheck flag, so the probe works in the scratch image
(no shell, no curl, no wget).
