Pass an explicit empty argv so cobra cannot reach os.Args

A nil argv lets cobra fall back to os.Args[1:], which under
`go test -args foo` turns the bare-invocation cases into
`certmanager foo` and resolves /opt/certmanager/config.yaml. Assert
the bare-invocation error on stderr so the fallback cannot hide.

Puppet gives the child a temp file as fd 1, not a pipe; say so.

README.md

@@ -30,9 +30,9 @@ and `help` are the subcommands; every other first argument is a common name.
 
 A bare invocation prints help and exits zero only when stdout is a terminal —
 a pipe, a file, a socket, `/dev/null` and a closed fd 1 all exit non-zero with
-nothing on stdout. Puppet's `generate()` reads stdout through a pipe, so there
-a missing common name fails the compile rather than feeding help text into the
-catalog.
+nothing on stdout. Puppet's `generate()` collects stdout through a temp file,
+so there a missing common name fails the compile rather than feeding help text
+into the catalog.
 
 | Flag | Short | Type | Default | Description |
 |---|---|---|---|---|