Everything-is-an-app: render cert-manager -artifacts into git manifests (one object per file)

Nobody has claimed this yet.

## Parent

linode/apl-core#3515

## What to build

Convert the pilot's `-artifacts` release (`cert-manager-artifacts`) from a directly-deployed Helm release into plain, git-stored manifests reconciled by the existing GitOps apps.

End-to-end behavior:
- During reconcile the operator renders the `-artifacts` release from its **unchanged** source (`charts/raw` + `values//-raw.gotmpl`), splits the multi-document stream, and writes **one Kubernetes object per file**, then commits before the GitOps app syncs.
- Path convention: `` folder is the **lowercased singular** kind (`clusterissuer`, `externalsecret`, `certificate`); filename is `metadata.name`.
- Namespaced objects → `env/manifests/namespaces///.yaml`
- Cluster-scoped objects → `env/manifests/global//.yaml`
- The `-artifacts` release no longer produces its own ArgoCD `Application`; the split files are reconciled by the existing `gitops-ns-` / `gitops-global` apps (recursive directory sync).
- The ADR-2026-08-20 Phase-1 bootstrap subset (`ExternalSecret/custom-ca`, `ClusterIssuer/custom-ca` when `customRootCA` is set) is still applied directly during initial install; the full set lands in git for ArgoCD post-install.

The multi-doc → per-file splitter should be a pure function (rendered YAML in, `{ path → single-object YAML }` out) so folder casing and namespaced-vs-global bucketing are unit-testable.

## Acceptance criteria

- [ ] Rendering `cert-manager-artifacts` produces one file per object under the correct `namespaces///.yaml` or `global//.yaml` path, with lowercased-singular kind folders.
- [ ] Cluster-scoped objects (e.g. `ClusterIssuer`) land under `env/manifests/global/...`; namespaced objects under `env/manifests/namespaces/...`.
- [ ] The `cert-manager-artifacts` release no longer creates its own `Application`; split files reconcile via the existing gitops-ns/global apps.
- [ ] Phase-1 custom-ca subset still applied directly at install per ADR-2026-08-20; full set committed to git.
- [ ] Unit tests cover the splitter's bucketing and kind-folder casing with a representative multi-object render.

## Blocked by

- linode/apl-core#3571

Start with the unchanged charts/raw source and values//-raw.gotmpl, then inspect the existing gitops-ns- and gitops-global applications plus ADR-2026-08-20. Define the splitter around the rendered multi-document YAML and add unit tests for namespaced, cluster-scoped, and lowercased-singular kind paths; done means the listed acceptance criteria pass after the blocker is resolved.

Written by the indexing model from the issue text.