catalog: DNS TXT domain verification for the verified tier #26

Surfaced by the design/security review on #25.

The catalog ships bundled in the wheel, and verified/ currently means "a maintainer checked it." Ownership itself is only a self-declared source domain + the PSL match — not proof of domain control. The strongest lightweight upgrade is DNS TXT verification (same pattern as Homebrew verified taps / Google domain verification).

Proposal

• To be verified/, the API owner adds _openapi-cli4ai.<registrable_domain> IN TXT "github=<maintainer>".
• CI resolves the TXT record (dnspython) during the PR and fails if it doesn't match the maintainer field.
• Surface a distinct domain-verified badge in catalog search/show/list, separate from the tier folder.

Acceptance

• CI check resolves + matches the TXT record
• domain-verified badge shown distinctly from verified/community
• Documented in CONTRIBUTING

Effort: M