Make intra-cluster NOTIFY loop-free (TSIG-keyed, no pod IPs in restart config)

v0.2.5 (PR #14) added an options-scope allow-notify enumerating the primary
pod IP on secondaries. Options-scope config feeds the config-hash annotation
that rolls the StatefulSet, so any config change rolled the pods, the primary
came back on a new pod IP, the operator re-rendered with the new IP, the hash
changed, the pods rolled again — an infinite roll loop across every
BindCluster. The prod deployment was reverted to v0.2.4.

Replace the pod-IP allow-notify with TSIG-authenticated NOTIFY:

- Secondaries render `allow-notify { key "<name>"; };` — a static key element
  with NO IPs. It depends only on the key name, so pod-IP churn can never
  change the render, the config-hash, or trigger a restart.
- The primary signs its outgoing NOTIFYs: the zone-scope also-notify entries
  (already enumerating replica pod IPs, applied via rndc addzone/modzone with
  NO restart) now carry `key "<name>"`.
- Key choice: reuse the cluster's catalog transfer TSIG key (TransferKeyRef).
  Secondaries already present it for AXFR and it is in keys.conf on every pod,
  so no new key plumbing is needed.

Add a permanent regression guard for the loop class:
- controller: reconcile the ConfigMap with the primary pod on two different
  IPs and assert the config-hash is byte-identical.
- render: render restart-scoped input and assert no pod IP appears in
  allow-notify; RenderInput no longer has any pod-IP field.

Zone-scope also-notify (rndc, no restart) legitimately still lists pod IPs;
only restart-scoped config must be pod-IP-independent.

internal/controller/bindzone_controller.go

@@ -88,7 +88,13 @@ func (r *BindZoneReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
 		notifyTargets = secondaryPodIPs(ctx, r.Client, cluster)
 	}
 
-	zoneConfig, err := r.buildZoneConfig(ctx, &zone, r.zoneTransferKeyRef(ctx, &zone, cluster), notifyTargets)
+	// The catalog transfer TSIG key doubles as the intra-cluster NOTIFY key: the
+	// primary signs its also-notify NOTIFYs with it and secondaries accept them
+	// via `allow-notify { key "<key>"; }`. Keying the NOTIFYs is what lets the
+	// secondary's allow-notify be a static key element (no pod IPs), so pod-IP
+	// churn never re-renders restart-scoped config (the v0.2.5 roll loop).
+	transferKey := r.zoneTransferKeyRef(ctx, &zone, cluster)
+	zoneConfig, err := r.buildZoneConfig(ctx, &zone, transferKey, notifyTargets, transferKey)
 	if err != nil {
 		return r.setPhase(ctx, &zone, "Error", "ConfigError", err.Error())
 	}
@@ -142,8 +148,10 @@ func (r *BindZoneReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
 
 // buildZoneConfig renders the inner clause passed to rndc addzone/modzone.
 // transferKey, when set, is the catalog transfer TSIG key name; catalog member
-// primary zones must allow AXFR with it so secondaries can pull them.
-func (r *BindZoneReconciler) buildZoneConfig(ctx context.Context, zone *bindv1alpha1.BindZone, transferKey string, notifyTargets []string) (string, error) {
+// primary zones must allow AXFR with it so secondaries can pull them. notifyKey,
+// when set, is the TSIG key each also-notify entry is signed with, so
+// secondaries can accept the NOTIFYs by key rather than by (churning) pod IP.
+func (r *BindZoneReconciler) buildZoneConfig(ctx context.Context, zone *bindv1alpha1.BindZone, transferKey string, notifyTargets []string, notifyKey string) (string, error) {
 	zType := zone.Spec.Type
 	if zType == "" {
 		zType = bindv1alpha1.ZonePrimary
@@ -164,9 +172,13 @@ func (r *BindZoneReconciler) buildZoneConfig(ctx context.Context, zone *bindv1al
 		}
 		// NOTIFY only the secondaries we know about (their apex NS is the primary
 		// itself, so default `notify yes` would reach no one). `notify explicit`
-		// keeps NOTIFY off the query-serving VIP and scoped to the pod IPs.
+		// keeps NOTIFY off the query-serving VIP and scoped to the pod IPs. Each
+		// entry is signed with notifyKey so secondaries can admit the NOTIFY by key
+		// (`allow-notify { key ... }`) instead of by pod IP. This zone config is
+		// applied via rndc addzone/modzone — no pod restart — so listing pod IPs
+		// here is safe; only *restart-scoped* config must never depend on pod IPs.
 		if len(notifyTargets) > 0 {
-			parts = append(parts, "notify explicit", fmt.Sprintf("also-notify { %s }", terminateInline(notifyTargets)))
+			parts = append(parts, "notify explicit", fmt.Sprintf("also-notify { %s }", alsoNotifyList(notifyTargets, notifyKey)))
 		}
 		if zone.Spec.DNSSECPolicyRef != "" {
 			parts = append(parts, fmt.Sprintf("dnssec-policy \"%s\"", zone.Spec.DNSSECPolicyRef), "inline-signing yes")