Adds a ClusterIP Service to the operator chart and an Ingress applied
after install, exposing the UI at fleet-stg.{base_domain} — coherent
with the sso-stg./secrets-stg. staging hosts.
- chart: ClusterIP Service on OPERATOR_HTTP_PORT (18080)
- K8sIngressScore: optional cluster_issuer → cert-manager.io/cluster-issuer
annotation + tls block + OKD edge-termination (no-op off OpenShift);
None keeps plain HTTP for issuer-less k3d. Render extracted + unit-tested.
- FleetOperatorScore.ingress(host, issuer): composes the ingress post-install;
unset (dev/e2e) leaves the UI cluster-internal.
- FleetDeployConfig: base_domain + cluster_issuer; CD binary derives the host.
HTTP->HTTPS redirect is unconfirmed on OKD (no portable Ingress annotation
in use here) and must be verified on staging.
