chore(render): let Renovate track the vendored origin-ca-issuer CRD source commit #4136

🤖 Generated by the Agentic Engineer

Evidence

#3635 vendored the two origin-ca-issuer CRDs so the controllers layer renders offline (#3405). They are now pinned to one upstream source commit plus two SHA-256 digests in scripts/update-vendored-operators.sh (origin_ca_issuer_commit, clusteroriginissuers_sha256, originissuers_sha256).

Nothing tracks that commit:

• .github/renovate.json has a custom manager for the cert-approver version constant in the same script, and none for origin_ca_issuer_commit.
• The origin-ca-issuer HelmRelease chart (0.6.4) is tracked by the Flux manager on its own. The chart does not ship these CRDs, so a chart bump can move ahead of the vendored CRDs and nothing reports it.
• CI's --validate-committed mode checks the committed bytes against the digests. A commit-only bump would still pass, because the bytes do not change.

Before #3635 the CRDs came from a moving upstream branch, so they tracked upstream implicitly. Vendoring made them reproducible, but also frozen.

Audience and impact

Operators of the platform. If a later chart release expects a newer CRD schema, the controller runs against stale CRDs and nothing flags it. Today the pin is correct; the risk is silent drift.

Expected behaviour

A newer upstream CRD source becomes visible as a Renovate PR, and that PR cannot go green until the vendored bytes and digests are refreshed to match the new commit.

Acceptance criteria

• Renovate proposes an update when the upstream CRD source moves. A digest-tracking custom manager on origin_ca_issuer_commit is one option; tying it to the chart's release tag is the other. Choose after checking which upstream ref the chart release corresponds to.
• A PR that bumps only the commit constant fails CI until the CRD bytes and both digests are refreshed. That is the same binding the cert-approver bump already has.
• The render stays offline: no https:// resource comes back (the existing remote-resource guard keeps enforcing this).

Note for the implementer

Mapping the pinned commit to an upstream release needs a read of the third-party upstream repository. An unattended run cannot do that under the professional-work repository boundary, so this needs an interactive session, or a CI job that performs the lookup.

Rough size: S. Part of #3405.