cert-manager sequential upgrade -> 1.21 (k8s 1.36 catch-up, final hop)

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/cert-manager/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: cert-manager
-      version: ">=1.20.0 <1.21.0"   # TODO(WS-SEC): pin at bring-up; Renovate maintains
+      version: ">=1.21.0 <1.22.0"   # TODO(WS-SEC): pin at bring-up; Renovate maintains
       sourceRef:
         kind: HelmRepository
         name: jetstack