Notify secondaries immediately on primary zone changes

Dynamically-updated primary zones were only reaching the secondary pods on
the hardcoded 1h SOA refresh: the operator emitted no NOTIFY, and a zone's
only apex NS is the primary itself, so default 'notify yes' reached no one.
Queries load-balanced across the serve VIP hit stale secondaries and
returned NXDOMAIN (negatively cached downstream for the 300s SOA minimum),
so records flapped for up to an hour after every update.

Add 'notify explicit' + 'also-notify' with the secondary pod IPs to primary
zone stanzas so an update NOTIFYs the secondaries for an immediate IXFR.
Applied via modzone, so existing zones pick it up on the next reconcile.
Also shorten the seed SOA refresh/retry/minimum as a fallback for missed
NOTIFYs and to shrink stale-NXDOMAIN negative caching.

internal/controller/helpers.go

@@ -3,6 +3,7 @@ package controller
 import (
 	"context"
 	"fmt"
+	"sort"
 	"time"
 
 	corev1 "k8s.io/api/core/v1"
@@ -126,6 +127,34 @@ func primaryTransferAddress(ctx context.Context, c client.Client, cluster *bindv
 	return primaryPodIP(ctx, c, cluster)
 }
 
+// secondaryPodIPs returns the pod IPs of a cluster's secondary pods (every pod
+// except the ordinal-0 primary) that currently have an address. The primary
+// uses this list as its zone `also-notify` set, so a change to a primary zone
+// (in particular a dynamic update) triggers an immediate NOTIFY -> IXFR to the
+// secondaries instead of leaving them stale until the next SOA refresh. The
+// list is sorted so the rendered zone config is stable and does not churn
+// modzone on every reconcile. Pod IPs change across restarts, so the caller
+// relies on the zone controller's periodic requeue to refresh the set (a
+// restarted secondary re-transfers the whole zone on load regardless). Returns
+// nil for a single-replica cluster.
+func secondaryPodIPs(ctx context.Context, c client.Client, cluster *bindv1alpha1.BindCluster) []string {
+	var pods corev1.PodList
+	if err := c.List(ctx, &pods, client.InNamespace(cluster.Namespace), client.MatchingLabels(commonLabels(cluster.Name))); err != nil {
+		return nil
+	}
+	primary := primaryPodName(cluster.Name)
+	var ips []string
+	for i := range pods.Items {
+		p := &pods.Items[i]
+		if p.Name == primary || p.Status.PodIP == "" {
+			continue
+		}
+		ips = append(ips, p.Status.PodIP)
+	}
+	sort.Strings(ips)
+	return ips
+}
+
 // resolveTSIG reads the material of a BindTSIGKey into TSIG credentials.
 func resolveTSIG(ctx context.Context, c client.Client, namespace, keyRef string) (bind.TSIGCreds, error) {
 	var creds bind.TSIGCreds