fix(olm): declare webhookDefinitions so OLM provisions the webhook cert

The hermes manager registers admission webhooks (RegisterHermesInstanceWebhook
mutating defaulter + validating, RegisterHermesClusterDefaultsWebhook,
RegisterHermesSelfConfigWebhook) and serves TLS on the webhook server (default
port 9443), but the bundle CSV declared no spec.webhookDefinitions.

Under OLM there is no cert-manager, so OLM only provisions the webhook serving
cert and creates the Validating/MutatingWebhookConfiguration when the CSV
declares the webhooks in spec.webhookDefinitions. Without it the manager crashes
with "open /tmp/k8s-webhook-server/serving-certs/tls.crt: no such file or
directory", CrashLoopBackOff, and the OperatorHub "Full operator test" (kiwi)
install fails. This is the real blocker keeping hermes off OperatorHub.

Add one webhookDefinitions entry per registered webhook (1 mutating, 3
validating) derived from config/webhook/manifests.yaml and the api/v1
+kubebuilder:webhook markers, plus expose containerPort 9443 (webhook-server) on
the manager container so OLM wires the service to the webhook server.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: stubbi

bundle/manifests/hermes-operator.clusterserviceversion.yaml

@@ -632,6 +632,10 @@ spec:
                     args:
                       - '--leader-elect'
                       - '--health-probe-bind-address=:8081'
+                    ports:
+                      - containerPort: 9443
+                        name: webhook-server
+                        protocol: TCP
                     securityContext:
                       allowPrivilegeEscalation: false
                       capabilities:
@@ -658,3 +662,84 @@ spec:
                       requests:
                         cpu: 100m
                         memory: 128Mi
+  webhookdefinitions:
+    - type: MutatingAdmissionWebhook
+      admissionReviewVersions:
+        - v1
+      containerPort: 443
+      targetPort: 9443
+      deploymentName: hermes-operator-controller-manager
+      failurePolicy: Fail
+      generateName: mhermesinstance.hermes.agent
+      rules:
+        - apiGroups:
+            - hermes.agent
+          apiVersions:
+            - v1
+          operations:
+            - CREATE
+            - UPDATE
+          resources:
+            - hermesinstances
+      sideEffects: None
+      webhookPath: /mutate-hermes-agent-v1-hermesinstance
+    - type: ValidatingAdmissionWebhook
+      admissionReviewVersions:
+        - v1
+      containerPort: 443
+      targetPort: 9443
+      deploymentName: hermes-operator-controller-manager
+      failurePolicy: Fail
+      generateName: vhermesinstance.hermes.agent
+      rules:
+        - apiGroups:
+            - hermes.agent
+          apiVersions:
+            - v1
+          operations:
+            - CREATE
+            - UPDATE
+          resources:
+            - hermesinstances
+      sideEffects: None
+      webhookPath: /validate-hermes-agent-v1-hermesinstance
+    - type: ValidatingAdmissionWebhook
+      admissionReviewVersions:
+        - v1
+      containerPort: 443
+      targetPort: 9443
+      deploymentName: hermes-operator-controller-manager
+      failurePolicy: Fail
+      generateName: vhermesclusterdefaults.hermes.agent
+      rules:
+        - apiGroups:
+            - hermes.agent
+          apiVersions:
+            - v1
+          operations:
+            - CREATE
+            - UPDATE
+          resources:
+            - hermesclusterdefaults
+      sideEffects: None
+      webhookPath: /validate-hermes-agent-v1-hermesclusterdefaults
+    - type: ValidatingAdmissionWebhook
+      admissionReviewVersions:
+        - v1
+      containerPort: 443
+      targetPort: 9443
+      deploymentName: hermes-operator-controller-manager
+      failurePolicy: Fail
+      generateName: vhermesselfconfig.hermes.agent
+      rules:
+        - apiGroups:
+            - hermes.agent
+          apiVersions:
+            - v1
+          operations:
+            - CREATE
+            - UPDATE
+          resources:
+            - hermesselfconfigs
+      sideEffects: None
+      webhookPath: /validate-hermes-agent-v1-hermesselfconfig