Remove unused cert-manager/webhook scaffolding

kubebuilder's generic scaffold defensively wires up webhook TLS-cert
machinery and an unconditional cert-manager install in the e2e suite, in
case a project grows admission webhooks later. This one never will --
the spec's non-goals explicitly rule out admission webhooks and
cert-manager wiring -- so none of it does anything. Verified before
removing: no config/webhook/, no +kubebuilder:webhook markers anywhere,
and config/*/kustomization.yaml's [CERTMANAGER] blocks are all inert
(never uncommented).

cmd/main.go: drops the webhook import, the three webhook-cert-* flags,
and the WebhookServer wiring on ctrl.Options -- the manager now runs
with no webhook server, correctly, since nothing registers one. Left
the metrics-cert flags alone; those are unrelated to webhooks.

test/e2e/e2e_suite_test.go: drops the unconditional cert-manager
install/uninstall around the suite.

test/utils/utils.go: drops the now-dead InstallCertManager/
UninstallCertManager/IsCertManagerCRDsInstalled and their warnError
helper, plus UncommentCode -- unrelated to cert-manager, but found to
have zero callers even before this cleanup.

Left the inert commented-out [WEBHOOK]/[CERTMANAGER] kustomize blocks
and kubebuilder's scaffold marker comments alone: pure comments, no
runtime behavior, unlike the cert-manager install this actually removed.

Verified clean with both build tags (go build/vet, and -tags=e2e for
test/e2e). make test unchanged and green.

Co-Authored-By: Claude <noreply@anthropic.com>

docs/plans-executions/2026-08-07-1747-proxy-operator.md

@@ -410,3 +410,70 @@ meaningfully uncovered function is `New()` itself, deliberately.
 `make test` green across the whole repo (`go build`/`go vet` clean,
 `internal/provider` 96.0%, `internal/provider/kubernetes` 77.6%,
 `internal/provider/registry` 100%, unchanged).
+
+## Cleanup — removed unused cert-manager/webhook scaffolding
+
+Not a plan step; the user asked for this directly after I explained what
+`make test-e2e` currently does, and didn't want unused scaffold machinery
+carried forward into later work.
+
+kubebuilder's generic scaffold assumes a project *might* grow admission
+webhooks later, so it wires up webhook TLS-cert machinery and an
+unconditional cert-manager install in the e2e suite defensively. Checked
+whether any of it was actually load-bearing before touching anything:
+
+```bash
+grep -rn "cert-manager\|certmanager\|CertManager" config/
+# only inside commented-out [CERTMANAGER] blocks in kustomization.yaml —
+# the whole block is inert, never uncommented
+grep -n "webhook" PROJECT
+# no output — kubebuilder create webhook was never run
+```
+
+Confirmed nothing here does anything for this project — no `config/webhook/`
+exists, no `+kubebuilder:webhook` markers exist anywhere, and the spec's
+own non-goals explicitly rule out admission webhooks and cert-manager
+wiring forever, not just "not yet."
+
+Removed:
+
+- **`cmd/main.go`**: the `webhook` import, the three `webhook-cert-*`
+  flags, the `webhookServerOptions`/`webhookServer` construction, and the
+  `WebhookServer:` field on `ctrl.Options` — the manager runs with no
+  webhook server at all now, which is correct since nothing registers one.
+  Left the metrics-cert flags alone (`--metrics-cert-path` etc.) — those
+  let real certs be mounted for the metrics endpoint without cert-manager,
+  which is unrelated to webhooks and still useful. Reworded a comment that
+  said "TODO(user): If you enable certManager..." since that will never
+  happen here.
+- **`test/e2e/e2e_suite_test.go`**: the unconditional cert-manager install
+  in `BeforeSuite` and matching uninstall in `AfterSuite`
+  (`setupCertManager`/`teardownCertManager`/`shouldCleanupCertManager`),
+  and the doc comment claiming the suite "requires Kind and CertManager"
+  (it only requires Kind now).
+- **`test/utils/utils.go`**: `InstallCertManager`, `UninstallCertManager`,
+  `IsCertManagerCRDsInstalled`, and their now-unused `warnError` helper and
+  `certmanagerVersion`/`certmanagerURLTmpl` constants. Also removed
+  `UncommentCode` — grepped first and confirmed it had zero callers even
+  before this cleanup; it was dead scaffold code from the start, unrelated
+  to cert-manager, just found while in there.
+
+Left the inert commented-out `[WEBHOOK]`/`[CERTMANAGER]` blocks in the
+`config/*/kustomization.yaml` files and the
+`+kubebuilder:scaffold:e2e-webhooks-checks`-style marker comments in
+`test/e2e/e2e_test.go` alone — those are standard kubebuilder codegen
+anchors and pure comments with no runtime behavior, unlike the cert-manager
+install this cleanup actually removed. Stripping every trace of "webhook"
+from every scaffold comment across the tree would be a much bigger, purely
+cosmetic diff for no behavioral benefit; this cleanup targeted the things
+that were actually *doing* something.
+
+Verified with both build tags, since `test/e2e` only compiles under `-tags=e2e`:
+
+```bash
+go build ./... && go vet ./...
+go build -tags=e2e ./... && go vet -tags=e2e ./...
+```
+
+Both clean. `make test` green across the whole repo, unchanged from before
+the cleanup.