reconcile zone apex NS off the pod IP placeholder

Add BindZone.spec.nameservers and sync the apex NS RRset on every reconcile.

config/crd/bases/bind.unkin.net_bindzones.yaml

@@ -94,6 +94,17 @@ spec:
                 items:
                   type: string
                 type: array
+              nameservers:
+                description: |-
+                  Nameservers are the names published in the zone's apex NS RRset, kept in
+                  sync on every reconcile. Each entry is a full domain name, never relative
+                  to the zone. Prefer out-of-zone names glued by the parent: an
+                  in-zone name needs an address record in the zone, and the seed can only
+                  supply the primary pod's (unstable) IP for it. When empty the apex NS is
+                  the primary's stable in-cluster DNS name.
+                items:
+                  type: string
+                type: array
               primaries:
                 description: Primaries lists source servers for a secondary/stub-type
                   zone.

config/crd/install.yaml

@@ -2760,6 +2760,17 @@ spec:
                 items:
                   type: string
                 type: array
+              nameservers:
+                description: |-
+                  Nameservers are the names published in the zone's apex NS RRset, kept in
+                  sync on every reconcile. Each entry is a full domain name, never relative
+                  to the zone. Prefer out-of-zone names glued by the parent: an
+                  in-zone name needs an address record in the zone, and the seed can only
+                  supply the primary pod's (unstable) IP for it. When empty the apex NS is
+                  the primary's stable in-cluster DNS name.
+                items:
+                  type: string
+                type: array
               primaries:
                 description: Primaries lists source servers for a secondary/stub-type
                   zone.