Initial bind-operator: 9 CRDs + controllers

Implements a Kubernetes operator that manages fleets of BIND9 servers
declaratively, using controller-runtime (matching forgebot conventions).

- add BindCluster reconciler: StatefulSet (pod-0 primary, secondaries),
  headless + client Services, rendered named.conf ConfigMap, TSIG keys
  Secret and rndc control Secret; watches dependent CRs to re-render
- add BindTSIGKey reconciler that generates key material into a Secret
- add BindZone/DNSRecord reconcilers using fully-dynamic delivery
  (rndc addzone + TSIG nsupdate against the primary pod)
- add BindCatalogZone reconciler so secondaries auto-provision zones
- add BindPolicy (RPZ), BindDNSSECPolicy, BindView, BindACL reconcilers
- render primary/secondary named.conf variants selected by pod ordinal
- generate CRDs, deepcopy and RBAC; add samples mapping the three Puppet
  roles (authoritative/resolver/external-dns) to three BindClusters
- add Makefile, Dockerfile.operator, Woodpecker CI and kind manifests

config/samples/02-resolver.yaml

@@ -0,0 +1,50 @@
+---
+# Recursive resolvers role (replaces 3x Puppet only-resolver servers).
+# All three pods are identical recursive servers; no zone replication.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: resolver
+  namespace: bind-resolver
+spec:
+  mode: resolver
+  replicas: 3
+  service:
+    type: LoadBalancer
+  forwarders:
+    - 1.1.1.1
+    - 9.9.9.9
+---
+# Conditional forwarding of an internal zone to the authoritative cluster.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: forward-internal
+  namespace: bind-resolver
+spec:
+  clusterRef: resolver
+  zoneName: internal.example.com
+  type: forward
+  catalog: false
+  forwarders:
+    - 10.0.0.53
+---
+# DNS firewall (RPZ) blocklist applied to the resolvers.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindPolicy
+metadata:
+  name: blocklist
+  namespace: bind-resolver
+spec:
+  clusterRef: resolver
+  zoneName: rpz.internal
+  order: 10
+  transferKeyRef: transfer-key
+  rules:
+    - trigger: qname
+      match: malware.example.
+      action: nxdomain
+    - trigger: qname
+      match: tracker.example.
+      action: cname
+      target: blocked.internal.example.com