Cold helm install of cert-manager pulls four quay.io/jetstack images
across three nodes from inside the QEMU sandbox. Image-pull contention
delays cert-manager controller readiness, which in turn keeps the
webhook Secret unissued and the downstream operator pods stalled in
ContainerCreating long enough to trip progressDeadlineSeconds. The
PackageSource dependency fix sequences cert-manager before its
consumers; pre-pulling shortens the cert-manager pod-start window so
the dependency wait doesn't itself blow the install budget.
Also refactors the prepull setup to iterate over a chart list rather
than duplicating mktemp/render/cat per package.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>