Fix zone provisioning: seed glue + IP primaries

Two bugs made every provisioned zone fail to load:

1. The seed zone's apex NS (ns1.<zone>) is in-zone but had no address
   record, so BIND check-integrity refused to load it and rndc addzone
   reverted. Add a glue A record pointing at the primary pod IP.
2. Secondaries rendered primaries/default-primaries with the primary's
   DNS name, but BIND only accepts IP addresses there (it read the name
   as a remote-servers list and failed config load, crash-looping the
   secondary). Render the primary pod IP instead, and watch Pods so the
   config re-renders when that IP appears or changes.

- bind.WriteSeedZone writes 'ns1 IN A <primaryIP>' glue
- controllers resolve primaryPodIP and pass it to the seed (requeue if
  the primary has no IP yet)
- BindCluster renders PrimaryAddress from pod-0's IP and watches Pods
- render omits catalog primaries when the IP is unknown (no empty list)

internal/bind/seed.go

@@ -26,14 +26,15 @@ func (e *Executor) ZoneExists(ctx context.Context, namespace, pod, zone, view st
 	return err == nil
 }
 
-// WriteSeedZone writes a minimal loadable zone file (SOA + apex NS) to path,
-// creating parent directories. It is only safe to call when creating a zone, as
-// it overwrites any existing file.
-func (e *Executor) WriteSeedZone(ctx context.Context, namespace, pod, zone, path, primaryNS string, serial int64) error {
+// WriteSeedZone writes a minimal loadable zone file (SOA + apex NS + glue) to
+// path, creating parent directories. The apex NS is the in-zone name ns1, and a
+// glue A record pointing at primaryIP is included so BIND's check-integrity
+// accepts the zone (an in-zone NS without an address record is a load error).
+// It is only safe to call when creating a zone, as it overwrites any existing
+// file. This is a placeholder that is replaced once real records are loaded.
+func (e *Executor) WriteSeedZone(ctx context.Context, namespace, pod, zone, path, primaryIP string, serial int64) error {
 	origin := dot(zone)
-	if primaryNS == "" {
-		primaryNS = "ns1." + origin
-	}
+	ns := "ns1." + origin
 	content := fmt.Sprintf(`$TTL 3600
 @ IN SOA %s hostmaster.%s (
     %d ; serial
@@ -42,7 +43,8 @@ func (e *Executor) WriteSeedZone(ctx context.Context, namespace, pod, zone, path
     1209600    ; expire
     300 )      ; minimum
 @ IN NS %s
-`, dot(primaryNS), origin, serial, dot(primaryNS))
+ns1 IN A %s
+`, ns, origin, serial, ns, primaryIP)
 
 	cmd := []string{"sh", "-c", fmt.Sprintf("mkdir -p \"$(dirname '%s')\" && cat > '%s'", path, path)}
 	if out, err := e.Exec(ctx, namespace, pod, cmd, content); err != nil {