Embedding cert-manager into CAPI for smaller footprint/less upgrade deps

I recently realized that the 3 cert-manager related processes we use in CAPI are actually not required when a cluster is running, and only required, i believe:
- on upgrades
- on creation of a new cluster

**User Story**

As a CAPI User I'd like to minimize the number of containers I need to run persistently in my cluster, and thus i'd like a like a default "batteries included" certificate management solution running in one my essential capi pods... so that i dont need to run certmanager after cluster creation.

i.e. the dumbed down version of this would be something like... "lets just vendor certmanager and use it when needed".

**Detailed Description**

I think these 3 services:
- ca-injector
- webhook
- certmanager

Can
- all be run as one off processes on startup
- invoked as needed during upgrades
- be non-existent at other times ?

**Anything else you would like to add:**

/kind feature

The issue mentions CAPI's ca-injector, webhook, and certmanager processes but names no files, tests, or entry points. Begin by locating how these processes are currently deployed and invoked during cluster creation and upgrades; done means a concrete, validated design for embedding or on-demand execution without the persistent dependency.

Written by the indexing model from the issue text.