Target upstream ISC bind9 image

Uses internetsystemsconsortium/bind9 as the default base image instead of
a self-hosted one, verified against internetsystemsconsortium/bind9:9.20
(runs as root; named/rndc/nsupdate at /usr/sbin,/usr/sbin,/usr/bin).

- project operator config at /etc/bind-operator instead of overmounting
  the image's /etc/bind (keeps bind.keys / base config intact)
- reference named/rndc/nsupdate by absolute path (exec PATH may exclude
  /usr/sbin)
- centralise filesystem + binary paths in internal/bind/consts.go
- default spec.image to internetsystemsconsortium/bind9:9.20

internal/controller/bindcluster_controller.go

@@ -109,7 +109,7 @@ func (r *BindClusterReconciler) reconcileRNDCSecret(ctx context.Context, c *bind
 		return genErr
 	}
 	keyClause := bind.KeyClause("rndc-key", "hmac-sha256", secret)
-	rndcConf := fmt.Sprintf("include \"/etc/bind/rndc.key\";\noptions {\n    default-key \"rndc-key\";\n    default-server 127.0.0.1;\n    default-port 953;\n};\n")
+	rndcConf := fmt.Sprintf("include \"%s\";\noptions {\n    default-key \"rndc-key\";\n    default-server 127.0.0.1;\n    default-port 953;\n};\n", bind.RndcKeyPath)
 	s := &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: c.Namespace, Labels: commonLabels(c.Name)},
 		Data: map[string][]byte{
@@ -259,7 +259,7 @@ func (r *BindClusterReconciler) reconcileStatefulSet(ctx context.Context, c *bin
 	replicas := c.Spec.Replicas
 	image := c.Spec.Image
 	if image == "" {
-		image = "git.unkin.net/unkin/bind9:latest"
+		image = defaultBindImage
 	}
 	storageSize := c.Spec.StorageSize
 	if storageSize == "" {
@@ -295,15 +295,15 @@ func (r *BindClusterReconciler) reconcileStatefulSet(ctx context.Context, c *bin
 						Name:            bind.ContainerName,
 						Image:           image,
 						ImagePullPolicy: c.Spec.ImagePullPolicy,
-						Command:         []string{"/bin/sh", "/etc/bind/entrypoint.sh"},
+						Command:         []string{"/bin/sh", bind.EntrypointPath},
 						Ports: []corev1.ContainerPort{
 							{Name: "dns-udp", ContainerPort: 53, Protocol: corev1.ProtocolUDP},
 							{Name: "dns-tcp", ContainerPort: 53, Protocol: corev1.ProtocolTCP},
 						},
 						Resources: c.Spec.Resources,
 						VolumeMounts: []corev1.VolumeMount{
-							{Name: "bind-etc", MountPath: "/etc/bind", ReadOnly: true},
-							{Name: "run", MountPath: "/run/named"},
+							{Name: "bind-etc", MountPath: bind.ConfigDir, ReadOnly: true},
+							{Name: "run", MountPath: bind.RunDir},
 							{Name: "data", MountPath: bind.DataDir},
 						},
 						ReadinessProbe: &corev1.Probe{