The prober (collect.go) was calling inferApexDNSKEYStatus during
zone parsing, effectively making a SECURE/BOGUS judgement inside the
collection phase rather than the evaluation phase. The DNS-rcode
fallback (z.Status = z.DNSStatus) was also applied at parse time.
Hosts that register the provider only for its definition (externalizable
checker) construct it with a nil CollectFn. If the local ObservationContext
ends up calling Collect, the previous code dereferenced a nil function
value and crashed the goroutine. Surface a typed error so rules degrade
to a clean StatusError state.
