reject an apex NS DNSRecord instead of appending to the live RRset

BIND ignores an RRset-wide delete at a zone apex, so a DNSRecord for the
apex NS can only add to what the zone was seeded with while reporting
success. BindZone.spec.nameservers converges it per rdata.

internal/controller/zone_helpers_test.go

@@ -77,3 +77,29 @@ func TestCatalogEnabledDefault(t *testing.T) {
 		t.Error("secondary zone should never be a catalog member")
 	}
 }
+
+func TestIsApexNS(t *testing.T) {
+	const zone = "acme.unkin.net"
+	cases := []struct {
+		name, typ string
+		want      bool
+	}{
+		{"@", "NS", true},
+		{"", "NS", true},
+		{"acme.unkin.net.", "NS", true},
+		{"ACME.UNKIN.NET.", "ns", true},
+		{"@", "ns", true},
+		// No trailing dot means relative: acme.unkin.net.acme.unkin.net.
+		{"acme.unkin.net", "NS", false},
+		{"sub", "NS", false},
+		{"ns1", "NS", false},
+		{"@", "TXT", false},
+		{"@", "MX", false},
+		{"@", "SOA", false},
+	}
+	for _, c := range cases {
+		if got := isApexNS(c.name, c.typ, zone); got != c.want {
+			t.Errorf("isApexNS(%q,%q)=%v want %v", c.name, c.typ, got, c.want)
+		}
+	}
+}