fix: Harden install-components against cert-manager/kyverno races

[scotwells]

Summary

A cold task install-components fails intermittently in two spots (hit repeatedly bringing up a fresh cluster for the dns-operator drift e2e):

1. cert-manager webhook race. install-cert-manager waits only for the cert-manager HelmRelease to be Ready, which does not mean the validating webhook is serving. Since install-components runs install-cert-manager and install-envoy-gateway-operator as concurrent deps, the gateway resources — which include a cert-manager Certificate — often apply before the webhook is up and fail:

   failed calling webhook "webhook.cert-manager.io": ... connect: connection refused
   

2. Kyverno transient fetch. install-kyverno builds a manifest from a remote source and occasionally dies on a cold run:

   accumulating resources from '.../kyverno/releases/download/...': net/http: TLS handshake timeout
   

Changes

• install-cert-manager now waits for the cert-manager-webhook Deployment and its Service endpoints before reporting ready, so downstream Certificate/Issuer applies don't hit a cold webhook.
• install-kyverno retries its build+apply (transient remote-manifest fetch).
• install-envoy-gateway-operator retries the gateway-resources apply (belt-and-suspenders against the webhook race / cold-start caBundle injection).

All three mirror the retry pattern already used for the OTel operator webhook in install-observability.

Test plan

• Taskfile.yml parses (task --list-all) and is valid YAML.
• Repeated cold task cluster-up / install-components runs no longer flake on the cert-manager webhook or the kyverno fetch.

🤖 Generated with Claude Code