feat(dns): 'hosts' output + /etc/hosts simulation docs

dns-records.sh <mode> hosts prints a marker-wrapped /etc/hosts block to pipe
into /etc/hosts (single-machine testing without a DNS server). README documents
apply/remove + the airgap caveat (spoof hosts break real internet while present).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -36,6 +36,28 @@ Alternatives: `ENABLE_MDNS=true` + `BASE_DOMAIN=*.local` (zero-config mDNS,
 macOS/Linux native, Windows needs Bonjour) — but mDNS can't serve the air-gap
 upstream spoofs. Or layer in `docker-compose.dnsmasq.yml` for a turnkey DNS.
 
+### Simulate the DNS via /etc/hosts (single machine, testing)
+
+No DNS server? Append the records straight to `/etc/hosts` (marker-wrapped):
+
+```sh
+tooling/dns-records.sh online hosts | sudo tee -a /etc/hosts   # services only
+tooling/dns-records.sh airgap hosts | sudo tee -a /etc/hosts   # + Mojang spoofs
+```
+
+Remove them later:
+
+```sh
+sudo sed -i '/# >>> ulicraft/,/# <<< ulicraft/d' /etc/hosts
+```
+
+Notes:
+- `/etc/hosts` has **no wildcard** — only the listed names resolve.
+- `airgap` adds the Mojang/launcher/NeoForge hostnames pointing at the LAN; this
+  **breaks normal internet access to those domains** while present. Use it only
+  while offline; for an online box use `online`.
+- `mc.<domain>` works (client defaults to :25565); SRV isn't used via `/etc/hosts`.
+
 ## Prerequisites
 
 Docker + Docker Compose; for prep also `pnpm`, `packwiz`, `jq`, `curl`,