Add a primary (write) Service routing to pod-0

Secondaries reject RFC2136/nsupdate writes, but the read Service round-
robins across all pods. Add an optional per-cluster write endpoint that
targets only the primary pod (ordinal 0) via the StatefulSet pod-name
label. Reads keep using the all-pods Service.

- api: BindCluster.spec.primaryService (*ClusterServiceSpec) — ClusterIP
  for in-cluster writers (external-dns) or LoadBalancer for external
- reconcilePrimaryService creates <cluster>-primary selecting pod-0 when
  set, deletes it when unset
- regenerate CRDs + install.yaml

internal/controller/helpers.go

@@ -29,11 +29,20 @@ const (
 )
 
 func headlessServiceName(cluster string) string { return cluster + "-headless" }
-func clientServiceName(cluster string) string   { return cluster }
-func primaryPodName(cluster string) string      { return cluster + "-0" }
-func configMapName(cluster string) string       { return cluster + "-config" }
-func keysSecretName(cluster string) string      { return cluster + "-keys" }
-func rndcSecretName(cluster string) string      { return cluster + "-rndc" }
+func primaryServiceName(cluster string) string  { return cluster + "-primary" }
+
+// primaryPodSelector selects only the primary pod (ordinal 0) via the stable
+// StatefulSet pod-name label, for the write Service.
+func primaryPodSelector(cluster string) map[string]string {
+	s := commonLabels(cluster)
+	s["statefulset.kubernetes.io/pod-name"] = primaryPodName(cluster)
+	return s
+}
+func clientServiceName(cluster string) string { return cluster }
+func primaryPodName(cluster string) string    { return cluster + "-0" }
+func configMapName(cluster string) string     { return cluster + "-config" }
+func keysSecretName(cluster string) string    { return cluster + "-keys" }
+func rndcSecretName(cluster string) string    { return cluster + "-rndc" }
 
 // primaryAddress is the in-cluster DNS name of the primary pod (ordinal 0).
 func primaryAddress(cluster, namespace string) string {