Target upstream ISC bind9 image

Uses internetsystemsconsortium/bind9 as the default base image instead of
a self-hosted one, verified against internetsystemsconsortium/bind9:9.20
(runs as root; named/rndc/nsupdate at /usr/sbin,/usr/sbin,/usr/bin).

- project operator config at /etc/bind-operator instead of overmounting
  the image's /etc/bind (keeps bind.keys / base config intact)
- reference named/rndc/nsupdate by absolute path (exec PATH may exclude
  /usr/sbin)
- centralise filesystem + binary paths in internal/bind/consts.go
- default spec.image to internetsystemsconsortium/bind9:9.20

internal/bind/consts.go

@@ -0,0 +1,37 @@
+package bind
+
+// Filesystem layout and binary locations inside a BIND pod. The operator mounts
+// its rendered config at ConfigDir (a path distinct from the image's own
+// /etc/bind, so the base image's bind.keys trust anchors remain available for
+// dnssec-validation).
+const (
+	// ContainerName is the BIND container name within each pod.
+	ContainerName = "bind"
+
+	// ConfigDir is where the operator projects named.conf, keys and the
+	// entrypoint. Kept separate from the image's /etc/bind.
+	ConfigDir = "/etc/bind-operator"
+
+	// DataDir is BIND's writable working directory (backed by the PVC): zone
+	// databases and journals.
+	DataDir = "/var/lib/named"
+
+	// RunDir holds the ordinal-selected named.conf (writable emptyDir).
+	RunDir = "/run/named"
+
+	// Binary locations in the ISC BIND9 image (Debian/Ubuntu layout).
+	NamedBin    = "/usr/sbin/named"
+	RndcBin     = "/usr/sbin/rndc"
+	NsupdateBin = "/usr/bin/nsupdate"
+)
+
+// Config file paths derived from ConfigDir.
+const (
+	NamedConfRun       = RunDir + "/named.conf"
+	NamedConfPrimary   = ConfigDir + "/named.conf.primary"
+	NamedConfSecondary = ConfigDir + "/named.conf.secondary"
+	EntrypointPath     = ConfigDir + "/entrypoint.sh"
+	KeysConfPath       = ConfigDir + "/keys.conf"
+	RndcKeyPath        = ConfigDir + "/rndc.key"
+	RndcConfPath       = ConfigDir + "/rndc.conf"
+)