fix(macos-container): preserve working builder dns

docs/prds/prd-new-macos-container-backend.md

@@ -171,9 +171,13 @@ delivery design lands.
   and verify that egress cannot bypass the sidecar. They also preflight
   Apple Container BuildKit DNS because image builds must resolve
   package mirrors before a launch smoke can be meaningful. The backend
-  starts/restarts the Apple Container builder with the configured DNS
-  server before image builds so BuildKit `RUN` steps inherit a working
-  resolver.
+  probes the running builder before image builds and leaves it alone
+  when its current resolver works. If the probe fails, or if the
+  operator explicitly sets `BOT_BOTTLE_MACOS_CONTAINER_DNS`, the backend
+  restarts the Apple Container builder with the configured DNS server.
+  Without an explicit override, that server is discovered from the
+  host's directly reachable IPv4 resolver before falling back to a
+  public resolver.
 
 ## References