Implement AXFR over TCP and RFC 2136 UPDATE with caller TSIG.

Callers get a session API, typed RR builders, and BIND testcontainer proof so CheckDNS can stay off the DNS wire.

Co-authored-by: Cursor <cursoragent@cursor.com>

testdata/bind/Dockerfile

@@ -0,0 +1,13 @@
+FROM ubuntu:24.04
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends bind9 \
+    && rm -rf /var/lib/apt/lists/* \
+    && mkdir -p /run/named /var/cache/bind \
+    && chown -R bind:bind /run/named /var/cache/bind
+COPY named.conf /etc/bind/named.conf
+COPY db.example.test /var/cache/bind/db.example.test
+RUN chown bind:bind /etc/bind/named.conf /var/cache/bind/db.example.test \
+    && chmod 644 /etc/bind/named.conf \
+    && chmod 664 /var/cache/bind/db.example.test
+EXPOSE 53/tcp 53/udp
+CMD ["/usr/sbin/named", "-f", "-g", "-u", "bind", "-c", "/etc/bind/named.conf"]

testdata/bind/named.conf

@@ -0,0 +1,33 @@
+options {
+    directory "/var/cache/bind";
+    listen-on port 53 { any; };
+    listen-on-v6 { none; };
+    allow-query { any; };
+    recursion no;
+    dnssec-validation no;
+    pid-file none;
+};
+
+logging {
+    channel stderr_log {
+        stderr;
+        severity info;
+        print-time yes;
+        print-category yes;
+    };
+    category default { stderr_log; };
+    category update { stderr_log; };
+    category update-security { stderr_log; };
+};
+
+key "go-dns-test" {
+    algorithm hmac-sha256;
+    secret "dGVzdC1maXh0dXJlLWhtYWMtc2hhMjU2LWtleSEhISE=";
+};
+
+zone "example.test" {
+    type master;
+    file "/var/cache/bind/db.example.test";
+    allow-update { key "go-dns-test"; };
+    allow-transfer { key "go-dns-test"; };
+};