9376bc3cb3
cert-manager-issued Certificates never synced to Konnect as KongCertificate objects through the Gateway API listener path, so dataplanes fell back to Kong's default self-signed cert. Reuse the working kong-namespace pattern (a static wildcard cert) via ExternalSecret instead.