Helm chart: ValidatingWebhookConfiguration caBundle not wired to webhook TLS cert

Problem

helm/temporal-worker-controller/templates/webhook.yaml sets:

clientConfig:
  caBundle: {{ .Values.certmanager.caBundle }}

only populated when certmanager.enabled: true (cert-manager CA injection). Deployments that supply their own TLS cert/key via --webhook-cert-dir/--webhook-cert-name/--webhook-key-name (#590) with certmanager.enabled: false have no supported path to get that cert's CA into caBundle — it's left as whatever static value the operator sets (or empty), so the API server can't validate the webhook server's TLS cert. Result: admission requests to WorkerResourceTemplate/WorkerDeployment webhooks fail the TLS handshake (failurePolicy: Fail blocks all such requests) even though the controller pod itself is healthy.

This is a separate failure mode from the crash-loop #590 fixes: the pod stays up, but the webhook is unreachable/untrusted by the API server.

Environments affected

Any deployment injecting webhook certs from outside cert-manager (e.g. platform-managed PKI sidecars/init that write cert+key to a fixed pod path) and setting certmanager.enabled: false.

Possible resolutions

• Static caBundle value: let certmanager.caBundle be set directly to a base64 CA bundle Helm value when certmanager.enabled: false, sourced from wherever the external cert issuer publishes its CA. Simple, but goes stale on CA rotation.
• CA-injector Job: a post-install/post-upgrade Helm hook Job that reads the live CA from a known path and patches caBundle on both ValidatingWebhookConfigurations at every deploy. Handles CA rotation, adds a Job + RBAC for patching webhook configs.

Happy to open a PR for either approach if there's a preference — flagging first since it changes the chart's values contract.

Start with helm/temporal-worker-controller/templates/webhook.yaml and the chart's certmanager values; trace how caBundle is rendered when certmanager.enabled is false. Review the two ValidatingWebhookConfigurations and choose a supported CA wiring approach, then render the chart to verify both configurations receive the intended bundle.