Implement AXFR over TCP and RFC 2136 UPDATE with caller TSIG.

Callers get a session API, typed RR builders, and BIND testcontainer proof so CheckDNS can stay off the DNS wire.

Co-authored-by: Cursor <cursoragent@cursor.com>

testdata/bind/named.conf

@@ -0,0 +1,33 @@
+options {
+    directory "/var/cache/bind";
+    listen-on port 53 { any; };
+    listen-on-v6 { none; };
+    allow-query { any; };
+    recursion no;
+    dnssec-validation no;
+    pid-file none;
+};
+
+logging {
+    channel stderr_log {
+        stderr;
+        severity info;
+        print-time yes;
+        print-category yes;
+    };
+    category default { stderr_log; };
+    category update { stderr_log; };
+    category update-security { stderr_log; };
+};
+
+key "go-dns-test" {
+    algorithm hmac-sha256;
+    secret "dGVzdC1maXh0dXJlLWhtYWMtc2hhMjU2LWtleSEhISE=";
+};
+
+zone "example.test" {
+    type master;
+    file "/var/cache/bind/db.example.test";
+    allow-update { key "go-dns-test"; };
+    allow-transfer { key "go-dns-test"; };
+};