Drop the broken single-cluster overlay and document the webhook patch

single-cluster/ was a strict subset of default/ and would have left the
manager crash-looping on startup (missing webhook serving cert mount and
no cert-manager CA injection wiring). default/ is the only overlay that
actually deploys end-to-end, so keep it as the canonical entry point and
delete single-cluster/.

Also adds a comment to base/webhook/kustomization.yaml making it clear
that manifests.yaml is generated by controller-gen and shouldn't be
edited directly — the patches in the same file rewrite the hardcoded
names that controller-gen produces.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: scotwells

config/base/webhook/kustomization.yaml

@@ -1,10 +1,13 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+# manifests.yaml is generated by controller-gen and should NOT be edited
+# directly — `make manifests` will overwrite it. The patches below rewrite
+# the hardcoded names that controller-gen produces so the rest of the bundle
+# can use static `compute-*` references.
 - manifests.yaml
 
-# controller-gen hardcodes the metadata names and the clientConfig.service.name;
-# rewrite them here so the rest of the bundle uses static `compute-*` references.
+patches:
 patches:
 - patch: |-
     - op: replace