Add BindZone.spec.nameservers and sync the apex NS RRset on every reconcile.
Guard the staged size as a string so an unmeasurable file fails closed.