retract apex NS from recorded state, not a live query

An unsigned localhost query silently returns nothing for a zone behind a
BindView, which would strand the placeholder. Record what was published instead.

api/v1alpha1/bindzone_types.go

@@ -126,6 +126,10 @@ type BindZoneStatus struct {
 	// RecordCount is the number of managed record sets applied.
 	// +optional
 	RecordCount int32 `json:"recordCount,omitempty"`
+	// Nameservers records the apex NS names the operator last published, so a
+	// change to spec.nameservers knows which entries to retract.
+	// +optional
+	Nameservers []string `json:"nameservers,omitempty"`
 	// Signed reports whether DNSSEC signing is active.
 	// +optional
 	Signed bool `json:"signed,omitempty"`

api/v1alpha1/zz_generated.deepcopy.go

@@ -1017,6 +1017,11 @@ func (in *BindZoneSpec) DeepCopy() *BindZoneSpec {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *BindZoneStatus) DeepCopyInto(out *BindZoneStatus) {
 	*out = *in
+	if in.Nameservers != nil {
+		in, out := &in.Nameservers, &out.Nameservers
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 	if in.Conditions != nil {
 		in, out := &in.Conditions, &out.Conditions
 		*out = make([]v1.Condition, len(*in))