rig major updates

rig/ctrl/addons/metrics-server.sh

@@ -2,7 +2,7 @@
 # metrics-server — makes `kubectl top` work (patched with --kubelet-insecure-tls for kind).
 # Notes: docs/notes/addons.md
 set -euo pipefail
-cd "$(dirname "$0")/.."
+cd "${RIG_CTRL:-$(dirname "$0")/..}"
 
 source ./lib/config.sh
 load_config
@@ -10,7 +10,9 @@ load_config
 K="kubectl --context ${KUBECONTEXT}"
 
 if ! $K get deployment -n kube-system metrics-server >/dev/null 2>&1; then
-    $K apply -f "https://github.com/kubernetes-sigs/metrics-server/releases/download/${METRICS_SERVER_VERSION}/components.yaml"
+    # The pinned manifest, verified on disk — never a URL applied directly.
+    manifest=$(bash ./deps.sh manifest METRICS_SERVER)
+    $K apply -f "$manifest"
 fi
 
 $K patch deployment metrics-server -n kube-system --type=json \