Maintenance status indicator, SSRF hardening, DNS output fixes
- Maintenance status indicator carried end to end through devops_status_check, devops_watch_stack, and devops_suggest_action (#44)
- IPv6 SSRF guard matches by prefix length instead of string prefix, closing real bypasses (#38)
- devops_check_dns elides per-resolver records that agree with the domain-level set (#41)
- devops_get_incidents guides an empty filter: "all" to the vendor's status page (#43)
- degraded-component output is uncapped and grouped by status (#39)
- README backend-list correction (gcp is a native adapter, not out of the registry)