simpler check and deps messages

rig/ctrl/addons/cert-manager.sh

@@ -1,10 +1,6 @@
 #!/usr/bin/env bash
-# cert-manager plus a self-signed cluster issuer.
-#
-# In a regulated estate almost everything is TLS, so the interesting question
-# during onboarding is "does this service present a cert my client trusts" — not
-# "can I reach a public ACME server". A local CA answers that offline, which is
-# also what makes the air-gapped profile usable.
+# cert-manager plus a self-signed cluster issuer (offline local CA).
+# Notes: docs/notes/addons.md
 set -euo pipefail
 cd "$(dirname "$0")/.."