docs(installer): say a CA-only cert secret must be Opaque

kubernetes.io/tls requires both tls.crt and tls.key, so a Secret that
carries only ca.crt is rejected under that type.

Assisted-by: LLM
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>

packages/core/installer/values.yaml

@@ -65,8 +65,9 @@ cozystackOperator:
   platformSourceSecret: ''
   # Name of the Secret in cozy-system namespace with TLS material for an OCI
   # platform source: `ca.crt` for a registry whose certificate is issued by a
-  # private CA, and/or `tls.crt`+`tls.key` for client certificate auth (type
-  # Opaque or kubernetes.io/tls). When non-empty, sets spec.certSecretRef on the
+  # private CA, and/or `tls.crt`+`tls.key` for client certificate auth. A
+  # CA-only Secret must be type Opaque: kubernetes.io/tls requires `tls.crt`
+  # and `tls.key`. When non-empty, sets spec.certSecretRef on the
   # generated OCIRepository; the operator rewrites that object on every start,
   # so a certSecretRef patched onto it by hand does not survive a restart.
   # The cozystack-packages source copies the spec, so it inherits the CA too.