Complete procedures with a way back.

Install a pinned cert-manager release, prove webhook and controller health, validate ACME staging through HTTP-01, promote one bounded certificate to production, design least-privilege DNS-01 for wildcards, and operate renewal without exposing private keys.

Deploy Blackbox Exporter 0.28.0 across independent external vantages with SSRF-safe egress, separate IPv4/IPv6 TLS modules, Prometheus relabeling, expiry alerts and nonpaging failure tests.