Render forward zones into named.conf on every pod

type:forward zones are pure configuration (conditional forwarding), not
replicated data, so a resolver needs them on all pods. They were being
rndc-addzone'd on the primary only, so queries hitting a secondary pod
missed the forwarding. Render them into named.conf instead.

- render forward zones inside their view (or top-level when no views)
- BindCluster lists type:forward zones and watches BindZone to re-render
- BindZone controller skips forward zones (config-managed, no addzone)
- unit test for forward-zone-in-view rendering

internal/controller/bindcluster_controller.go

@@ -206,6 +206,17 @@ func (r *BindClusterReconciler) reconcileConfigMap(ctx context.Context, c *bindv
 		}
 	}
 
+	// Forward zones are configuration (no data), so they are rendered into
+	// named.conf on every pod rather than added dynamically to the primary.
+	var zones bindv1alpha1.BindZoneList
+	if err := r.List(ctx, &zones, client.InNamespace(c.Namespace)); err == nil {
+		for _, z := range zones.Items {
+			if z.Spec.ClusterRef == c.Name && z.Spec.Type == bindv1alpha1.ZoneForward {
+				in.Forwards = append(in.Forwards, z)
+			}
+		}
+	}
+
 	var catalogs bindv1alpha1.BindCatalogZoneList
 	if err := r.List(ctx, &catalogs, client.InNamespace(c.Namespace)); err == nil {
 		for i := range catalogs.Items {
@@ -416,6 +427,15 @@ func (r *BindClusterReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		Watches(&bindv1alpha1.BindDNSSECPolicy{}, handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, o client.Object) []reconcile.Request {
 			return mapToCluster(o.(*bindv1alpha1.BindDNSSECPolicy).Spec.ClusterRef, o.GetNamespace())
 		})).
+		Watches(&bindv1alpha1.BindZone{}, handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, o client.Object) []reconcile.Request {
+			// Only forward zones affect named.conf; primary/secondary zones are
+			// managed dynamically by the BindZone controller.
+			z := o.(*bindv1alpha1.BindZone)
+			if z.Spec.Type != bindv1alpha1.ZoneForward {
+				return nil
+			}
+			return mapToCluster(z.Spec.ClusterRef, o.GetNamespace())
+		})).
 		Watches(&bindv1alpha1.BindCatalogZone{}, handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, o client.Object) []reconcile.Request {
 			return mapToCluster(o.(*bindv1alpha1.BindCatalogZone).Spec.ClusterRef, o.GetNamespace())
 		})).