Widen letsencrypt-production DNS-01 solver to cover ha.huskypup.net

GitLab's new Gitaly/workhorse TLS certs are the first thing needing a
real Let's Encrypt cert under ha.huskypup.net (the cross-site floating-
hostname zone) - everything else there (Postgres) uses CNPG's own
self-signed certs, never hit this gap. Confirmed live: DNS-01 order
failed with 'no configured challenge solvers can be used for this
challenge' until this zone was added to the selector.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure/cert-manager/manifests/letsencrypt-issuer.yaml

@@ -1,15 +1,15 @@
----
+---
-apiVersion: cert-manager.io/v1
+apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
+kind: ClusterIssuer
-metadata:
+metadata:
-  name: letsencrypt-production
+  name: letsencrypt-production
-spec:
+spec:
-  acme:
+  acme:
-    server: https://acme-v02.api.letsencrypt.org/directory
+    server: https://acme-v02.api.letsencrypt.org/directory
-    email: garrettstone499@gmail.com
+    email: garrettstone499@gmail.com
-    privateKeySecretRef:
+    privateKeySecretRef:
-      name: letsencrypt-production
+      name: letsencrypt-production
-    solvers:
+    solvers:
       - dns01:
           cloudflare:
             email: garrettstone499@gmail.com
@@ -19,6 +19,17 @@ spec:
         selector:
           dnsZones:
             - "kube.huskypup.net"
+            # GitLab cross-site replication (see
+            # /home/scooby/.claude/plans/jiggly-snacking-iverson.md) -
+            # first real Let's Encrypt cert needed for anything under
+            # ha.huskypup.net (the floating-hostname zone used for
+            # cross-site Postgres/Gitaly addressing) - everything
+            # before this used CNPG's own self-signed certs, never hit
+            # this gap. Confirmed live: DNS-01 order failed with "no
+            # configured challenge solvers can be used for this
+            # challenge" until this zone was added. Same Cloudflare
+            # account/token as kube.huskypup.net.
+            - "ha.huskypup.net"
 
 ---
 apiVersion: cert-manager.io/v1