The split-DNS feature was unused: this VPN's internal resolver refuses
queries over the tunnel and its names resolve publicly. The wrapper's
only real job is blocking the DNS hijack, so drop the resolvectl
split-DNS path (and VPN_DNS_DOMAINS / F5_DNS_DOMAINS) and rename to
reflect that it's a guard, not a splitter.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>