Drop redundant dynamic cluster mode

The dynamic mode produced a byte-identical cluster to authoritative:
RFC2136 update capability is a per-zone property (BindZone.dynamicUpdate
+ updateKeyRef render allow-update { key ... }), not a cluster role. The
external-dns tier is just an authoritative cluster whose zones allow
dynamic updates.

- remove BindMode dynamic from the enum and constants
- switch the external-dns sample to mode authoritative
- update README migration mapping

api/v1alpha1/bindcluster_types.go

@@ -7,20 +7,19 @@ import (
 
 // BindMode selects the behaviour of a BindCluster and maps onto a classic
 // BIND deployment role.
-//   - authoritative: serves signed/unsigned authoritative zones. Ordinal-0 is
-//     the primary that holds zone data; the remaining pods are secondaries that
-//     replicate via AXFR/IXFR + NOTIFY (optionally driven by a catalog zone).
+//   - authoritative: serves authoritative zones. Ordinal-0 is the primary that
+//     holds zone data; the remaining pods are secondaries that replicate via
+//     AXFR/IXFR + NOTIFY (optionally driven by a catalog zone). Zones that set
+//     spec.dynamicUpdate accept RFC2136 TSIG updates (the external-dns pattern),
+//     so no separate mode is needed for external-dns servers.
 //   - resolver: N identical recursive resolvers, no zone replication.
-//   - dynamic: like authoritative, but the primary accepts RFC2136 TSIG updates
-//     (the external-dns pattern); secondaries replicate the result.
 //
-// +kubebuilder:validation:Enum=authoritative;resolver;dynamic
+// +kubebuilder:validation:Enum=authoritative;resolver
 type BindMode string
 
 const (
 	ModeAuthoritative BindMode = "authoritative"
 	ModeResolver      BindMode = "resolver"
-	ModeDynamic       BindMode = "dynamic"
 )
 
 // ClusterServiceSpec controls how the cluster is exposed to clients.