Initial bind-operator: 9 CRDs + controllers

Implements a Kubernetes operator that manages fleets of BIND9 servers
declaratively, using controller-runtime (matching forgebot conventions).

- add BindCluster reconciler: StatefulSet (pod-0 primary, secondaries),
  headless + client Services, rendered named.conf ConfigMap, TSIG keys
  Secret and rndc control Secret; watches dependent CRs to re-render
- add BindTSIGKey reconciler that generates key material into a Secret
- add BindZone/DNSRecord reconcilers using fully-dynamic delivery
  (rndc addzone + TSIG nsupdate against the primary pod)
- add BindCatalogZone reconciler so secondaries auto-provision zones
- add BindPolicy (RPZ), BindDNSSECPolicy, BindView, BindACL reconcilers
- render primary/secondary named.conf variants selected by pod ordinal
- generate CRDs, deepcopy and RBAC; add samples mapping the three Puppet
  roles (authoritative/resolver/external-dns) to three BindClusters
- add Makefile, Dockerfile.operator, Woodpecker CI and kind manifests

config/samples/03-external-dns.yaml

@@ -0,0 +1,43 @@
+---
+# external-dns role (replaces 3x Puppet external-dns servers). The primary
+# accepts RFC2136 TSIG updates from external-dns; secondaries replicate.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: externaldns
+  namespace: bind-externaldns
+spec:
+  mode: dynamic
+  replicas: 3
+  service:
+    type: LoadBalancer
+---
+# Public zone that external-dns writes into via nsupdate/TSIG.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: example-com
+  namespace: bind-externaldns
+spec:
+  clusterRef: externaldns
+  zoneName: example.com
+  type: primary
+  dynamicUpdate: true
+  updateKeyRef: externaldns-key
+  allowTransfer:
+    - key externaldns-key
+---
+# A record managed as a CRD (external-dns-style) instead of via the RFC2136
+# controller — same write path (TSIG nsupdate to the primary).
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: www-example-com
+  namespace: bind-externaldns
+spec:
+  zoneRef: example-com
+  name: www
+  type: A
+  ttl: 300
+  values:
+    - 203.0.113.10