Notify secondaries immediately on primary zone changes

Dynamically-updated primary zones were only reaching the secondary pods on
the hardcoded 1h SOA refresh: the operator emitted no NOTIFY, and a zone's
only apex NS is the primary itself, so default 'notify yes' reached no one.
Queries load-balanced across the serve VIP hit stale secondaries and
returned NXDOMAIN (negatively cached downstream for the 300s SOA minimum),
so records flapped for up to an hour after every update.

Add 'notify explicit' + 'also-notify' with the secondary pod IPs to primary
zone stanzas so an update NOTIFYs the secondaries for an immediate IXFR.
Applied via modzone, so existing zones pick it up on the next reconcile.
Also shorten the seed SOA refresh/retry/minimum as a fallback for missed
NOTIFYs and to shrink stale-NXDOMAIN negative caching.

internal/bind/seed.go

@@ -35,13 +35,19 @@ func (e *Executor) ZoneExists(ctx context.Context, namespace, pod, zone, view st
 func (e *Executor) WriteSeedZone(ctx context.Context, namespace, pod, zone, path, primaryIP string, serial int64) error {
 	origin := dot(zone)
 	ns := "ns1." + origin
+	// Short refresh/retry so a secondary that misses a NOTIFY (e.g. its pod IP
+	// changed and the primary's also-notify was briefly stale) still converges
+	// in minutes, not the hour a 3600s refresh would impose. minimum is the
+	// negative-cache TTL: keep it low so a stale-secondary NXDOMAIN does not
+	// stick in downstream resolvers for long. NOTIFY (also-notify on the
+	// primary) remains the fast path; these are the fallback.
 	content := fmt.Sprintf(`$TTL 3600
 @ IN SOA %s hostmaster.%s (
     %d ; serial
-    3600       ; refresh
-    900        ; retry
+    300        ; refresh
+    60         ; retry
     1209600    ; expire
-    300 )      ; minimum
+    60 )       ; minimum
 @ IN NS %s
 ns1 IN A %s
 `, ns, origin, serial, ns, primaryIP)