Target upstream ISC bind9 image

Uses internetsystemsconsortium/bind9 as the default base image instead of
a self-hosted one, verified against internetsystemsconsortium/bind9:9.20
(runs as root; named/rndc/nsupdate at /usr/sbin,/usr/sbin,/usr/bin).

- project operator config at /etc/bind-operator instead of overmounting
  the image's /etc/bind (keeps bind.keys / base config intact)
- reference named/rndc/nsupdate by absolute path (exec PATH may exclude
  /usr/sbin)
- centralise filesystem + binary paths in internal/bind/consts.go
- default spec.image to internetsystemsconsortium/bind9:9.20

internal/bind/rndc.go

@@ -6,12 +6,9 @@ import (
 	"strings"
 )
 
-// RndcConfPath is the operator-managed rndc client config mounted in each pod.
-const RndcConfPath = "/etc/bind/rndc.conf"
-
 // Rndc runs `rndc <args...>` on a pod and returns its output.
 func (e *Executor) Rndc(ctx context.Context, namespace, pod string, args ...string) (string, error) {
-	base := []string{"rndc", "-c", RndcConfPath}
+	base := []string{RndcBin, "-c", RndcConfPath}
 	return e.Exec(ctx, namespace, pod, append(base, args...), "")
 }