docs(helm): document cert-manager operator mTLS setup

[TaylorMutch]

Summary

Document how to issue and use an operator mTLS client certificate with cert-manager and a Helm-deployed gateway. The guide covers a standalone Certificate, explicit gateway authentication settings, and certificate verification.

Related Issue

Closes #4630

Changes

• Add copyable Helm values and a standalone cert-manager Certificate with exact OU=operator, client authentication usage, and a dedicated Secret to Managing Certificates.
• Document client CA trust, release/namespace naming, direct connectivity, certificate extraction and verification, restricted Secret access, renewal, and certificate lifecycle ownership.
• Link to the procedure from gateway authentication/configuration, the chart README, and deployment troubleshooting guidance.
• Correct the page title and link text to “Workspaces on Kubernetes,” with maintainer permission to include that documentation correction.

Testing

• Documentation and navigation validation: mise run docs (zero errors; three warnings).
• Markdown lint and git diff --check.
• Live validation with the helm-dev-environment local cluster: redeployed the chart with the documented Helm values, applied the standalone Certificate extracted from the guide, and waited for issuance. The operator retrieved a synthetic credential through GetProviderCredentials; the ordinary client was denied. Disabling operator authentication denied both certificates. Operator authentication was restored afterward.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Relevant user documentation and deployment guidance updated

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4633.docs.buildwithfern.com/openshell

[TaylorMutch]

gator-agent

Maintainer Approval Needed

Gator reviewed the complete documentation patch and found no blocking issues. The operator certificate procedure is consistent with the chart's CA configuration and gateway mTLS authentication; the related documentation links and troubleshooting guidance are included.

Action required: A human maintainer must review and approve this PR.

Gator metadata

• Validation: Implements accepted issue docs: document cert-manager operator mTLS certificate setup #4630 with a standalone cert-manager Certificate procedure; no chart templates or runtime behavior changed.
• Docs: Fern documentation updated in place; no new navigation entry needed.
• Review: No blocking findings or carried obligations remain.
• Checks: Current-head DCO, issue acceptance, Branch Checks, Helm Lint, and Trivy Changes passed.
• E2E: No test labels required for this documentation-only patch. E2E and GPU E2E gate statuses are successful; runtime suites were skipped, not executed.
• Head SHA: 85f3666509c94be4e8a200ee75276970471c2742
• Base SHA: 633cc6dee6eb2491617cce7a8a7f722797588648
• Merge base SHA: 10241ab47b3b83cf5c9e9c854951c663a3af2c99
• Patch ID: 264d0190d06363c2375bd1e685a18542f4adc671
• Gator payload: 12
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no convergence decision required
• Next state: gator:approval-needed