Repair cert-manager TLS Issuance

Fix issuer scope and the TLS Secret contract for a Certificate.

A intermediate Linux challenge worth 10 points. Solve it hands-on in a real Linux environment in your browser - no local setup, no fake shells.

The Challenge

storefront is NotReady. Reference platform-ca as a ClusterIssuer, and change storefront-tls to type kubernetes.io/tls with tls.crt and tls.key. Apply and run check.