Fix validate-except syntax: trailing semicolon after last entry

named requires every entry in the list to be semicolon-terminated,
including the last one before the closing brace; without it named fails
config parse (missing ';' before '}') and crash-loops.

apps/base/bind-internal/resolvers/cluster.yaml

@@ -29,7 +29,7 @@ spec:
   # insecure so they are not validated. unkin.net covers all *.unkin.net
   # (incl. k8s.syd1.au.unkin.net); 18.198.in-addr.arpa covers every reverse zone.
   extraOptions:
-    - "validate-except { unkin.net; 18.198.in-addr.arpa; consul }"
+    - "validate-except { unkin.net; 18.198.in-addr.arpa; consul; }"
   resources:
     requests:
       cpu: 20m