Initial bind-operator: 9 CRDs + controllers

Implements a Kubernetes operator that manages fleets of BIND9 servers
declaratively, using controller-runtime (matching forgebot conventions).

- add BindCluster reconciler: StatefulSet (pod-0 primary, secondaries),
  headless + client Services, rendered named.conf ConfigMap, TSIG keys
  Secret and rndc control Secret; watches dependent CRs to re-render
- add BindTSIGKey reconciler that generates key material into a Secret
- add BindZone/DNSRecord reconcilers using fully-dynamic delivery
  (rndc addzone + TSIG nsupdate against the primary pod)
- add BindCatalogZone reconciler so secondaries auto-provision zones
- add BindPolicy (RPZ), BindDNSSECPolicy, BindView, BindACL reconcilers
- render primary/secondary named.conf variants selected by pod ordinal
- generate CRDs, deepcopy and RBAC; add samples mapping the three Puppet
  roles (authoritative/resolver/external-dns) to three BindClusters
- add Makefile, Dockerfile.operator, Woodpecker CI and kind manifests

internal/bind/keygen.go

@@ -0,0 +1,34 @@
+package bind
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+)
+
+// GenerateSecret returns a base64-encoded cryptographically-random key of n
+// bytes, suitable for a TSIG or rndc HMAC secret.
+func GenerateSecret(n int) (string, error) {
+	buf := make([]byte, n)
+	if _, err := rand.Read(buf); err != nil {
+		return "", fmt.Errorf("read random: %w", err)
+	}
+	return base64.StdEncoding.EncodeToString(buf), nil
+}
+
+// KeyClause renders a named.conf `key` block for inclusion.
+func KeyClause(name, algorithm, secret string) string {
+	return fmt.Sprintf("key \"%s\" {\n    algorithm %s;\n    secret \"%s\";\n};\n", name, algorithm, secret)
+}
+
+// SecretBytesForAlgorithm returns a reasonable key length for a TSIG algorithm.
+func SecretBytesForAlgorithm(algorithm string) int {
+	switch algorithm {
+	case "hmac-sha512", "hmac-sha384":
+		return 64
+	case "hmac-sha256":
+		return 32
+	default:
+		return 32
+	}
+}