Initial bind-operator: 9 CRDs + controllers

Implements a Kubernetes operator that manages fleets of BIND9 servers
declaratively, using controller-runtime (matching forgebot conventions).

- add BindCluster reconciler: StatefulSet (pod-0 primary, secondaries),
  headless + client Services, rendered named.conf ConfigMap, TSIG keys
  Secret and rndc control Secret; watches dependent CRs to re-render
- add BindTSIGKey reconciler that generates key material into a Secret
- add BindZone/DNSRecord reconcilers using fully-dynamic delivery
  (rndc addzone + TSIG nsupdate against the primary pod)
- add BindCatalogZone reconciler so secondaries auto-provision zones
- add BindPolicy (RPZ), BindDNSSECPolicy, BindView, BindACL reconcilers
- render primary/secondary named.conf variants selected by pod ordinal
- generate CRDs, deepcopy and RBAC; add samples mapping the three Puppet
  roles (authoritative/resolver/external-dns) to three BindClusters
- add Makefile, Dockerfile.operator, Woodpecker CI and kind manifests

internal/bind/hash.go

@@ -0,0 +1,29 @@
+package bind
+
+import (
+	"crypto/sha1"
+	"encoding/hex"
+	"strings"
+)
+
+// catalogHash returns the unique member label for a catalog zone entry: the
+// hex-encoded SHA-1 digest of the member zone name in DNS wire format, per the
+// BIND catalog-zone schema (RFC 9432).
+func catalogHash(zone string) string {
+	sum := sha1.Sum(wireName(zone))
+	return hex.EncodeToString(sum[:])
+}
+
+// wireName encodes a domain name into uncompressed DNS wire format: each label
+// length-prefixed, terminated by a zero-length root label. Names are lowercased.
+func wireName(name string) []byte {
+	name = strings.TrimSuffix(strings.ToLower(strings.TrimSpace(name)), ".")
+	var out []byte
+	if name != "" {
+		for _, label := range strings.Split(name, ".") {
+			out = append(out, byte(len(label)))
+			out = append(out, []byte(label)...)
+		}
+	}
+	return append(out, 0)
+}