cmctl, the cert-manager CLI, has no internal RPM, so hosts install it by hand and get no shell or `kubectl cert-manager` completion.
- add cmctl 2.6.1 package for el9 and fedora 42-44, verified against upstream checksums.txt
- generate bash/zsh/fish completions at build time
- ship `kubectl-cert_manager` symlink and `kubectl_complete-cert_manager` for kubectl plugin completion
Requires terraform-artifactapi github allowlist entries for cert-manager/cmctl.
Reviewed-on: #182
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
