Volatile detection:
- Remove single-record restriction (count<=1) that missed multi-record
  domains like youtube.com with 4 rotating AAAA records
- Add diff-resolvers check: domain is volatile if local and extra DNS
  return different IPs (catches cached TTL > threshold cases)
- expand_volatile_subnets now also processes domains with accumulated
  volatile_ips from prior runs, not only current volatile_domains
  (fixes race where cached TTL > threshold causes empty volatile_domains
  but IPs were already collected)

IP validation:
- Validate resolved IPs with python3 ipaddress before ip-batch loading
- Filter out invalid entries (e.g. malformed IPv6) with WARNING log
- Prevents ip-batch failures from corrupting route tables
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>