Implement AXFR over TCP and RFC 2136 UPDATE with caller TSIG.

Callers get a session API, typed RR builders, and BIND testcontainer proof so CheckDNS can stay off the DNS wire.

Co-authored-by: Cursor <cursoragent@cursor.com>

testdata/bind/Dockerfile

@@ -0,0 +1,13 @@
+FROM ubuntu:24.04
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends bind9 \
+    && rm -rf /var/lib/apt/lists/* \
+    && mkdir -p /run/named /var/cache/bind \
+    && chown -R bind:bind /run/named /var/cache/bind
+COPY named.conf /etc/bind/named.conf
+COPY db.example.test /var/cache/bind/db.example.test
+RUN chown bind:bind /etc/bind/named.conf /var/cache/bind/db.example.test \
+    && chmod 644 /etc/bind/named.conf \
+    && chmod 664 /var/cache/bind/db.example.test
+EXPOSE 53/tcp 53/udp
+CMD ["/usr/sbin/named", "-f", "-g", "-u", "bind", "-c", "/etc/bind/named.conf"]