Avoid rndc loadkeys race in checkds system test

Avoid rndc loadkeys race in checkds system test

The wait loop in test_checkds() called "rndc loadkeys" once per
second while polling ns9.log for expected parental-agent response
lines. Under load (notably the rbt CI job), responses to one query
batch could land after a subsequent loadkeys had already reset the
per-key DSPUBCOUNT counter in lib/dns/zone.c without cancelling the
in-flight requests. Stragglers from the earlier round then bumped the
new round's counter to parentalscnt and BIND finalized DSPublish for
zones where one parental-agent legitimately serves no DS, spuriously
failing the !DSPublish keystate assertion.

Trigger at most one loadkeys per test case and wait passively via
watch_log_from_start() / wait_for_all().  Watching from the start
of the log preserves the original implicit semantics for zones
whose DS state was already finalized by BIND's automatic checkds
polling at zone-load time -- the expected lines are already
present and the watcher returns immediately.

Assisted-by: Claude:claude-opus-4-7
(cherry picked from commit 02b6239489549e44daac123f556f851dd9949b27)