Accept intra-cluster NOTIFY on secondaries via allow-notify

Secondaries transfer catalog member and plain secondary zones from the
primary Service ClusterIP (stable across primary pod restarts), and BIND
derives a zone's implicit allow-notify from its primaries list. But the
primary pod's NOTIFYs egress with its *pod* IP as source — k8s Services
NAT only the inbound direction — so BIND refuses them as "refused notify
from non-primary" and replication falls back to the SOA refresh timer, a
1-hour propagation delay on every dynamic zone (external-dns RFC2136 and
dns-updater nsupdates alike).

Render an options-scope allow-notify on secondaries covering the primary
pod IP (and the transfer address, since an explicit allow-notify replaces
the primaries-derived default). The cluster controller resolves the
primary pod IP the same way it already does for seeding/also-notify, and
the existing Pod watch re-renders the ConfigMap when the pod IP changes.

internal/controller/bindcluster_controller.go

@@ -176,6 +176,14 @@ func (r *BindClusterReconciler) reconcileConfigMap(ctx context.Context, c *bindv
 	// across primary pod restarts (falls back to the pod IP when no primary
 	// Service exists; the Pod/Service watches re-render when it changes).
 	in := bind.RenderInput{Cluster: c, PrimaryAddress: primaryTransferAddress(ctx, r.Client, c)}
+	// Secondaries transfer from the stable primary Service ClusterIP, but the
+	// primary pod's NOTIFYs are sourced from its pod IP, which BIND refuses as
+	// "non-primary" unless it appears in allow-notify. Render the primary pod IP
+	// so intra-cluster NOTIFYs are accepted immediately (the Pod watch re-renders
+	// the ConfigMap when the pod IP changes across restarts).
+	if ip := primaryPodIP(ctx, r.Client, c); ip != "" {
+		in.PrimaryPodAddresses = []string{ip}
+	}
 
 	var acls bindv1alpha1.BindACLList
 	if err := r.List(ctx, &acls, client.InNamespace(c.Namespace)); err == nil {