Keep list copies on disk, start from them, and stop logging address overrides

Found by rolling the resolver out to the real cluster.

BlockList objects have no path, deliberately, so the first rollout downloaded
the list at every start. The cluster DNS that the download needs is this very
resolver, which was not up yet, so the first compile failed after 14 seconds,
held the DNS listeners closed for that long, and left the pod with no ad
blocking at all. Three changes:

* Lists from cluster objects get a copy under the runtime's own data directory
  (data/lists/<name>), chosen by the runtime from the object's name, never by the
  object.
* The copy is used as the answer only while it is younger than the list's
  refresh interval, and otherwise the list is downloaded again, with the old copy
  as the fallback if that fails. Before, any copy on disk was treated as current
  for ever, so a list with a path was frozen at its first download. A source now
  ages from its file, an operator's "refresh now" forces a download, and a
  failed download keeps the stale copy.
* Startup loads only what is on disk (RefreshOffline), opens the listeners, and
  fetches stale or missing lists in the background. The resolver answers at once
  and the network is never on its critical path.

An address override answered as a redirect and so counted as a policy action:
with the access log logging redirects, every lookup of an internal name wrote a
line. Overrides from the managed source are local answers now; a redirect a list
imposes is still logged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/kubesource/merge.go

@@ -66,6 +66,14 @@ func Merge(base *config.Config, snap *Snapshot) (*config.Config, []string) {
 			dropped = append(dropped, "BlockList "+l.Name+" (name used in the YAML)")
 			continue
 		}
+		// A cluster object cannot name a file, so the runtime picks one: a copy
+		// of the list under its own data directory. It is what lets a restart
+		// start with the list when the network (or the cluster DNS, which may
+		// be this very resolver) is not up yet.
+		if filepath.Base(l.Name) == l.Name && l.Name != "." && l.Name != ".." {
+			l.Path = filepath.Join("lists", l.Name)
+			l.Path = filepath.Join(filepath.Dir(base.CachePath()), l.Path)
+		}
 		// The same defaults config.applyDefaults gives a YAML list.
 		if l.Format == "" {
 			l.Format = "auto"