ci(e2e): install cert-manager into kind before installing the chart

Plan 2 Task 33 wired a cert-manager Issuer + Certificate into the chart for
the validating webhook, but the e2e workflow doesn't install cert-manager
first — so `helm upgrade --install` fails with
"no matches for kind \"Certificate\" in version \"cert-manager.io/v1\"".

Install jetstack/cert-manager with crds.enabled=true and --wait before the
chart upgrade, matching how production clusters bootstrap.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: stubbi

.github/workflows/e2e.yaml

@@ -16,6 +16,14 @@ jobs:
           cluster_name: hermes-operator-e2e
           config: hack/kind-config.yaml
       - uses: azure/setup-helm@v4
+      - name: Install cert-manager
+        run: |
+          helm repo add jetstack https://charts.jetstack.io
+          helm repo update
+          helm install cert-manager jetstack/cert-manager \
+            --namespace cert-manager --create-namespace \
+            --set crds.enabled=true \
+            --wait --timeout 5m
       - name: Build operator image
         run: make docker-build IMG=hermes-operator:dev
       - name: Load image into kind