Fix zone provisioning: seed glue + IP primaries

Two bugs made every provisioned zone fail to load:

1. The seed zone's apex NS (ns1.<zone>) is in-zone but had no address
   record, so BIND check-integrity refused to load it and rndc addzone
   reverted. Add a glue A record pointing at the primary pod IP.
2. Secondaries rendered primaries/default-primaries with the primary's
   DNS name, but BIND only accepts IP addresses there (it read the name
   as a remote-servers list and failed config load, crash-looping the
   secondary). Render the primary pod IP instead, and watch Pods so the
   config re-renders when that IP appears or changes.

- bind.WriteSeedZone writes 'ns1 IN A <primaryIP>' glue
- controllers resolve primaryPodIP and pass it to the seed (requeue if
  the primary has no IP yet)
- BindCluster renders PrimaryAddress from pod-0's IP and watches Pods
- render omits catalog primaries when the IP is unknown (no empty list)

internal/bind/render.go

@@ -206,6 +206,9 @@ func catalogZonesClause(in RenderInput, isPrimary bool, indent string) string {
 	if len(primaries) == 0 && in.PrimaryAddress != "" {
 		primaries = []string{in.PrimaryAddress}
 	}
+	if len(primaries) == 0 {
+		return ""
+	}
 	var b strings.Builder
 	b.WriteString(indent + "catalog-zones {\n")
 	b.WriteString(fmt.Sprintf("%s    zone \"%s\" default-primaries { %s };\n", indent, in.Catalog.Spec.ZoneName, terminate(primaries)))
@@ -227,6 +230,12 @@ func renderCatalogZoneDecl(in RenderInput, isPrimary bool, indent string) string
 	if len(primaries) == 0 && in.PrimaryAddress != "" {
 		primaries = []string{in.PrimaryAddress}
 	}
+	if len(primaries) == 0 {
+		// Primary IP not known yet; omit the secondary catalog zone rather than
+		// emit an invalid empty primaries list. A Pod-triggered reconcile renders
+		// it once the primary pod has an IP.
+		return ""
+	}
 	var b strings.Builder
 	b.WriteString(fmt.Sprintf("%szone \"%s\" {\n", indent, cat.Spec.ZoneName))
 	b.WriteString(indent + "    type secondary;\n")