Drop redundant dynamic cluster mode

The dynamic mode produced a byte-identical cluster to authoritative:
RFC2136 update capability is a per-zone property (BindZone.dynamicUpdate
+ updateKeyRef render allow-update { key ... }), not a cluster role. The
external-dns tier is just an authoritative cluster whose zones allow
dynamic updates.

- remove BindMode dynamic from the enum and constants
- switch the external-dns sample to mode authoritative
- update README migration mapping

README.md

@@ -38,7 +38,7 @@ script picks one based on the pod ordinal.
 
 | Kind | Purpose |
 |------|---------|
-| `BindCluster` | A set of BIND9 servers. `spec.mode`: `authoritative`, `resolver`, or `dynamic`. |
+| `BindCluster` | A set of BIND9 servers. `spec.mode`: `authoritative` or `resolver`. |
 | `BindZone` | A forward/reverse zone (`primary`/`secondary`/`forward`/`stub`), records inline, optional dynamic-update + DNSSEC + catalog membership. |
 | `DNSRecord` | A single record set applied via TSIG `nsupdate` — external-dns as a CRD. |
 | `BindView` | A split-horizon view (`match-clients`, ordering, per-view recursion). |
@@ -58,7 +58,7 @@ The three Puppet-managed BIND roles map onto three `BindCluster`s:
 |-------------|---------------|------|
 | 3× authoritative masters | `auth` | `authoritative` (pod-0 primary, 2 secondaries) |
 | 3× only-resolvers | `resolver` | `resolver` (3 identical recursive servers) |
-| 3× external-dns | `externaldns` | `dynamic` (RFC2136 TSIG updates on primary) |
+| 3× external-dns | `externaldns` | `authoritative` (zones set `dynamicUpdate` for RFC2136 TSIG updates) |
 
 ## Development