Target upstream ISC bind9 image

Uses internetsystemsconsortium/bind9 as the default base image instead of
a self-hosted one, verified against internetsystemsconsortium/bind9:9.20
(runs as root; named/rndc/nsupdate at /usr/sbin,/usr/sbin,/usr/bin).

- project operator config at /etc/bind-operator instead of overmounting
  the image's /etc/bind (keeps bind.keys / base config intact)
- reference named/rndc/nsupdate by absolute path (exec PATH may exclude
  /usr/sbin)
- centralise filesystem + binary paths in internal/bind/consts.go
- default spec.image to internetsystemsconsortium/bind9:9.20

internal/bind/exec.go

@@ -14,9 +14,6 @@ import (
 	"k8s.io/client-go/tools/remotecommand"
 )
 
-// ContainerName is the BIND container name within each pod.
-const ContainerName = "bind"
-
 // Executor runs commands inside BIND pods via the exec subresource.
 type Executor struct {
 	config    *rest.Config