fix(dns): avoid panics inside Tokio runtimes

[bnkc]

Summary

• detect an active Tokio runtime before invoking the synchronous Trust-DNS resolver
• run blocking DNS work on a named worker thread only in that case, preserving the existing non-Tokio path
• convert worker startup or panic failures into validation errors
• cover current-thread and multithread Tokio execution, including the public EmailValidator path

Compatibility

This keeps the synchronous API intact and does not require a breaking async-only API or a Hickory migration. Tokio 1.21 is now declared directly because it was already required transitively by trust-dns-resolver.

Test plan

• cargo test --lib (165 passed)
• cargo check --all-targets
• cargo clippy --all-targets with the existing repository lint exceptions
• uv run --no-sync pytest -q (114 passed against a freshly rebuilt extension)
• targeted rustfmt and git diff checks
• GitHub Actions: all 15 applicable distribution jobs passed

Stack

This PR is stacked on #34 and intentionally targets fix/polars-validation-errors-33.

Merge order:

1. Merge feat(polars): expose validation errors #34 into main.
2. Retarget this PR to main.
3. Merge this PR.

Closes #31