Per review, the *.unkin.net Let's Encrypt wildcard is no longer minted
per-namespace. A single Certificate (wildcard-unkin-net) now lives in the
cert-manager namespace and carries emberstack reflector source annotations via
spec.secretTemplate.annotations, so its secret (wildcard-unkin-net-tls) is
auto-reflected into consumer namespaces. Future consumers are added by
appending to the comma-separated reflection-*-namespaces lists.
Drop apps/base/cheeztv/certificate.yaml and its kustomization entry, and point
the public cheeztv gateway https listener at the reflected wildcard-unkin-net-tls
secret. cheeztv-internal keeps its Vault PKI leaf.
unkin-agent
00ea8af1e1