Stop discovery suppression failing open on configured hosts

Discovery fingerprints hosts on the scanned subnet, and its PBS fallback
probes api2/json/status and api2/json/config/datastore with no credentials,
which PBS records as authentication failures. Configured connections are meant
to be skipped for exactly that reason, so every gap in the skip writes noise
into an operator's own server log on every scan (#1616, split from #1606).

Two paths failed open. Hostname resolution kept only the first IPv4 and broke
out of the loop, leaving a multi-homed host partly suppressed while discovery
reaches whichever address it reaches. Resolution failure returned nothing at
all with no record that suppression had been skipped, so the host stayed
scannable and looked identical to one that was never configured.

Resolution now covers every IPv4 a configured host answers with, and both a
lookup failure and an IPv4-less answer are logged as the suppression gaps they
are. An unresolvable host still yields no entry, which is unavoidable, but it
no longer does so silently and cannot affect the other configured hosts.

This does not by itself explain the reporter's case in #1616. Their sanitized
export rewrites the PBS host to a generated placeholder, so it cannot show
whether the connection was configured by address or by name.

Verified: internal/monitoring, gofmt, canonical completion guard, status,
control-plane, registry and contract audits, active-target automated and
hybrid readiness proofs, and all thirteen release-control unit test modules.

docs/release-control/v6/internal/subsystems/monitoring.md

@@ -236,6 +236,18 @@ also preserve the unreported sentinel rather than collapsing an absent facet
 onto the struct zero value, because `0` is a real reading meaning no endurance
 remains.
 
+Discovery suppression for configured connections is a fail-closed obligation,
+not a best-effort optimisation. Every configured PVE, PBS and PMG host is
+resolved into the discovery IP blocklist so the scanner never fingerprints a
+connection Pulse already holds credentials for. Those fingerprint probes are
+unauthenticated by construction and land in the operator's own server logs as
+authentication failures, so a host that escapes suppression is visible damage
+on someone else's system rather than a missed optimisation. Resolution must
+cover every IPv4 address a configured host answers with, not the first, because
+the scanner reaches whichever address it reaches. A host that cannot be resolved
+yields no entry and must say so in the log rather than passing silently, and it
+must never prevent the remaining configured hosts from being suppressed.
+
 ## Canonical Files
 
 1. `internal/monitoring/monitor.go`