Point cert-manager DNS-01 self-check at public recursive nameservers

unkin.net is split-horizon: the _acme-challenge.unkin.net delegation CNAME
to _acme-challenge.acme.unkin.net exists only in the public Google Cloud
DNS view. cert-manager CNAME following resolved via in-cluster CoreDNS and
the nodes internal resolver, which serves an internal view lacking that
CNAME, so Follow found no delegation and still targeted zone unkin.net on
bind-external, giving NOTAUTH. Follow needs a public-view resolver for both
the CNAME chase and the propagation self-check.

- Set acmeDNS01.recursiveNameservers to 8.8.8.8:53 and 1.1.1.1:53 with
  recursiveNameserversOnly true in the cert-manager ControllerConfiguration
  so DNS-01 resolution and self-checks use the public DNS view.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

apps/overlays/au-syd1/cert-manager/values.yaml

@@ -5,6 +5,11 @@ config:
   apiVersion: controller.config.cert-manager.io/v1alpha1
   kind: ControllerConfiguration
   enableGatewayAPI: true
+  acmeDNS01:
+    recursiveNameservers:
+      - "8.8.8.8:53"
+      - "1.1.1.1:53"
+    recursiveNameserversOnly: true
 
 replicaCount: 2