Multiple bug fixes including the following

[ebourgeois]

1. DNS record ops (RRset replace, delete error handling, TTL, IPv6)
2. Records reconciler (orphan cleanup + publishedName, records patch key, failure-path status)
3. bind9 HTTP/auth (token rotation, zone_exists 404, timeouts, rndc parser)

• Data-plane safety: MX/TXT/NS/SRV/CAA now replace RRsets instead of appending duplicates; deletion failures (NOTAUTH/REFUSED) surface as errors; unselected/renamed records are cleaned out of BIND9 (new publishedName status field); transient API errors can no longer trigger deletion of live DNS records.
• Availability: the bindcar auth token is re-read on rotation (no more 401s after 1h); HTTP timeouts let retry/backoff actually work; zone Ready is now honest (instance-based counting, Ready=False on failures).
• Convergence: the observedGeneration family is fixed at all three sites plus the new observedParentGeneration field, ending several permanent reconcile loops; drift detection checks the right namespaces; finalizers use guarded JSON patches and no longer deadlock deletion when pods are down.
• Deployability: custom configMapRefs and rndcKey.secretRef actually work now; DNSSEC signing no longer crashloops named; forwarders/listenOn are rendered; bindy bootstrap operator produces a 0.7-authenticating operator.