🐛 Tighten close-call caching, timeouts and evidence merging - #608

Follow-ups from the review of #606.

• Close-call memory evicts expired results first, then only the oldest, instead of dropping all 64 when full.
• A close-call check shares one 5s deadline across the DNS lookup and the TCP connect (it could take 10s before). The private-address dialer is unchanged.
• Merging the lead check's evidence builds a fresh slice, so the check's own backing array is never written into.