fix(cert-manager): DNS-01 self-check via public resolvers (split-horizon)

The wildcard cert stalled: challenge Presented=true (Cloudflare TXT created OK —
token works) but propagation self-check looped 'DNS record not yet propagated'.
Verified the record IS publicly resolvable (1.1.1.1/8.8.8.8); the NAT'd k3s-dev
cluster's own DNS just can't see it. Set dns01RecursiveNameservers=1.1.1.1:53,
8.8.8.8:53 + dns01RecursiveNameserversOnly=true so the self-check bypasses cluster
DNS. Realises the pre-existing TODO in this file.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/cert-manager/helmrelease.yaml

@@ -24,5 +24,10 @@ spec:
   values:
     crds:
       enabled: true      # install CRDs with the chart
-    # TODO(WS-SEC, Phase 2): DNS-01 recursive nameserver config if split-horizon DNS interferes
-    #   with propagation checks (docs/09 split-horizon note).
+    # DNS-01 self-check via PUBLIC resolvers. The k3s-dev cluster is NAT'd and its DNS can't resolve
+    # the public _acme-challenge TXT that cert-manager creates in Cloudflare (VERIFIED: the record IS
+    # publicly resolvable via 1.1.1.1/8.8.8.8, but the in-cluster self-check timed out — "not yet
+    # propagated"). Point the propagation check straight at public resolvers so it never relies on
+    # cluster/split-horizon DNS (docs/09 split-horizon note; realises the TODO that was here).
+    dns01RecursiveNameservers: "1.1.1.1:53,8.8.8.8:53"
+    dns01RecursiveNameserversOnly: true