rig major updates

rig/ctrl/addons/cert-manager.sh

@@ -2,7 +2,7 @@
 # cert-manager plus a self-signed cluster issuer (offline local CA).
 # Notes: docs/notes/addons.md
 set -euo pipefail
-cd "$(dirname "$0")/.."
+cd "${RIG_CTRL:-$(dirname "$0")/..}"
 
 source ./lib/config.sh
 load_config
@@ -12,7 +12,9 @@ K="kubectl --context ${KUBECONTEXT}"
 if $K get deployment -n cert-manager cert-manager >/dev/null 2>&1; then
     echo "  already installed"
 else
-    $K apply -f "https://github.com/cert-manager/cert-manager/releases/download/${CERT_MANAGER_VERSION}/cert-manager.yaml"
+    # The pinned manifest, verified on disk — never a URL applied directly.
+    manifest=$(bash ./deps.sh manifest CERT_MANAGER)
+    $K apply -f "$manifest"
 fi
 
 echo "  waiting for cert-manager..."