Target upstream ISC bind9 image

Uses internetsystemsconsortium/bind9 as the default base image instead of
a self-hosted one, verified against internetsystemsconsortium/bind9:9.20
(runs as root; named/rndc/nsupdate at /usr/sbin,/usr/sbin,/usr/bin).

- project operator config at /etc/bind-operator instead of overmounting
  the image's /etc/bind (keeps bind.keys / base config intact)
- reference named/rndc/nsupdate by absolute path (exec PATH may exclude
  /usr/sbin)
- centralise filesystem + binary paths in internal/bind/consts.go
- default spec.image to internetsystemsconsortium/bind9:9.20

internal/controller/util.go

@@ -2,6 +2,7 @@ package controller
 
 import (
 	"context"
+	"fmt"
 
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -10,6 +11,7 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	bindv1alpha1 "git.unkin.net/unkin/bind-operator/api/v1alpha1"
+	"git.unkin.net/unkin/bind-operator/internal/bind"
 )
 
 func intstrFromInt(i int) intstr.IntOrString { return intstr.FromInt(i) }
@@ -26,17 +28,17 @@ func podReady(pod *corev1.Pod) bool {
 // entrypointScript selects the primary or secondary named.conf based on the
 // pod's StatefulSet ordinal and launches named in the foreground.
 func entrypointScript() string {
-	return `#!/bin/sh
+	return fmt.Sprintf(`#!/bin/sh
 set -eu
 ORD="${HOSTNAME##*-}"
 if [ "$ORD" = "0" ]; then
-    cp /etc/bind/named.conf.primary /run/named/named.conf
+    cp %[1]s %[3]s
 else
-    cp /etc/bind/named.conf.secondary /run/named/named.conf
+    cp %[2]s %[3]s
 fi
-mkdir -p /var/lib/named/zones /var/lib/named/catalog
-exec named -g -c /run/named/named.conf
-`
+mkdir -p %[4]s/zones %[4]s/catalog
+exec %[5]s -g -c %[3]s
+`, bind.NamedConfPrimary, bind.NamedConfSecondary, bind.NamedConfRun, bind.DataDir, bind.NamedBin)
 }
 
 func (r *BindClusterReconciler) upsertService(ctx context.Context, c *bindv1alpha1.BindCluster, desired *corev1.Service) error {