cert-manager: make update wipes cert-manager-crds/templates, and no check reaches across the package boundary #4119

packages/system/cert-manager/Makefile ends its update recipe with rm -rf ../cert-manager-crds/templates/*, then moves the CRDs it pulled into that directory. cert-manager-crds has no update target of its own, so all of its templates come from a sibling package's recipe.

Nothing breaks today: that directory holds only the six upstream CRD manifests and _helpers.tpl, and the moves put them back. The problem is the first hand-written file someone adds there. The next make update in cert-manager deletes it and exits 0, and nothing in cert-manager-crds hints that this can happen.

Same failure as #4028, one package boundary out. The invariant in #4097 stops short of it on purpose, and its header explains why: following a removal into another directory needs a second helper, not a wider pattern.

Cheapest fix is a line in cert-manager-crds/Makefile saying its templates are refilled by the sibling and that hand-written files there do not survive, so the warning sits where someone would be adding one. Growing the invariant is the other half.