Everything-is-an-app: render cert-manager -artifacts into git manifests (one object per file)

[j-zimnowoda]

Parent

#3515

What to build

Convert the pilot's -artifacts release (cert-manager-artifacts) from a directly-deployed Helm release into plain, git-stored manifests reconciled by the existing GitOps apps.

End-to-end behavior:

• During reconcile the operator renders the -artifacts release from its unchanged source (charts/raw + values/<app>/<app>-raw.gotmpl), splits the multi-document stream, and writes one Kubernetes object per file, then commits before the GitOps app syncs.
• Path convention: <kind> folder is the lowercased singular kind (clusterissuer, externalsecret, certificate); filename is metadata.name.
  • Namespaced objects → env/manifests/namespaces/<namespace>/<kind>/<name>.yaml
  • Cluster-scoped objects → env/manifests/global/<kind>/<name>.yaml
• The -artifacts release no longer produces its own ArgoCD Application; the split files are reconciled by the existing gitops-ns-<namespace> / gitops-global apps (recursive directory sync).
• The ADR-2026-08-20 Phase-1 bootstrap subset (ExternalSecret/custom-ca, ClusterIssuer/custom-ca when customRootCA is set) is still applied directly during initial install; the full set lands in git for ArgoCD post-install.

The multi-doc → per-file splitter should be a pure function (rendered YAML in, { path → single-object YAML } out) so folder casing and namespaced-vs-global bucketing are unit-testable.

Acceptance criteria

• Rendering cert-manager-artifacts produces one file per object under the correct namespaces/<ns>/<kind>/<name>.yaml or global/<kind>/<name>.yaml path, with lowercased-singular kind folders.
• Cluster-scoped objects (e.g. ClusterIssuer) land under env/manifests/global/...; namespaced objects under env/manifests/namespaces/....
• The cert-manager-artifacts release no longer creates its own Application; split files reconcile via the existing gitops-ns/global apps.
• Phase-1 custom-ca subset still applied directly at install per ADR-2026-08-20; full set committed to git.
• Unit tests cover the splitter's bucketing and kind-folder casing with a representative multi-object render.

Blocked by

• Everything-is-an-app: pilot cert-manager end-to-end (app-of-apps + settings + values) #3571