Bundle CRDs into a single install manifest

Adds config/crd/install.yaml (all 9 CRDs concatenated) so downstream
GitOps can reference the CRDs by a single stable raw URL instead of
vendoring copies.

- make generate now writes config/crd/install.yaml from config/crd/bases

Makefile

@@ -15,11 +15,17 @@ lint:
 fmt:
 	gofmt -w .
 
-## generate: regenerate deepcopy, CRDs and RBAC from kubebuilder markers
+CRD_BUNDLE := config/crd/install.yaml
+
+## generate: regenerate deepcopy, CRDs and RBAC from kubebuilder markers, then
+## bundle every CRD into a single applyable manifest ($(CRD_BUNDLE)) so it can
+## be referenced by a stable raw URL.
 generate:
 	controller-gen object paths="./api/..."
 	controller-gen crd paths="./api/..." output:crd:artifacts:config=config/crd/bases
 	controller-gen rbac:roleName=bind-operator paths="./internal/controller/..." output:rbac:dir=config/rbac
+	printf '# Generated by "make generate". DO NOT EDIT.\n' > $(CRD_BUNDLE)
+	cat config/crd/bases/*.yaml >> $(CRD_BUNDLE)
 
 manifests: generate