ci: build BIND against OPNsense LMDB ABI

[bryanwieg]

Summary

• build the managed BIND pair against OPNsense's lmdb0 package and liblmdb.so.0 ABI
• require every external package dependency to resolve from the target OPNsense repository in all release verification gates
• add regression coverage for the build dependency and repository restrictions

Production finding

The published 9.20.27 package linked to liblmdb.so.1 because build-bind920.sh preinstalled FreeBSD lmdb while the BIND port declares databases/lmdb0. OPNsense 26.7 provides only lmdb0, so named failed to load after package installation. The ha-2 transaction was rolled back before service restart and remains healthy on 9.20.26_2.

Verification

• pytest -q .github/ci/ci-tests (291 passed, 3 subtests passed)
• git diff --check
• live failure reproduced and rollback verified on opnsense-ha-2.home.internal.bkwfamily.net