Problem

KAITO currently uses Knative's pkg/webhook framework for admission webhooks. This introduces unnecessary complexity:

• Heavy dependency — knative.dev/pkg is large but only used for webhook registration and certificate management
• Dual runtime — Both workspace and ragengine binaries run a controller-runtime Manager alongside a separate Knative sharedmain goroutine just for webhooks, with a hardcoded time.Sleep(2s) for synchronization
• Ecosystem inconsistency — kaito-project/keda-kaito-scaler already uses open-policy-agent/cert-controller with controller-runtime natively

Proposal

Replace Knative webhook infrastructure with controller-runtime's native webhook server + cert-controller for certificate management:

1. Certificate management — Replace knative.dev/pkg/webhook/certificates with cert-controller's rotator.AddRotator, same pattern as keda-kaito-scaler
2. Webhook server — Use mgr.GetWebhookServer().Register() instead of sharedmain.MainWithConfig, eliminating the separate goroutine and sleep hack
3. Validation interface — Migrate CRD types from Knative's resourcesemantics.GenericCRD (Validate() *apis.FieldError) to controller-runtime's webhook.CustomValidator (ValidateCreate/Update/Delete)
4. Helm charts — Remove Knative-specific templates (secret-webhook-cert.yaml, knative-logging-configmap.yaml), update RBAC roles for cert-controller permissions, update webhook service port if needed
5. Cleanup — Remove knative.dev/pkg from go.mod

Scope

• cmd/workspace/main.go, cmd/ragengine/main.go
• pkg/workspace/webhooks/, pkg/ragengine/webhooks/
• api/v1alpha1/ and api/v1beta1/ validation & defaulting files
• Helm charts for both workspace and ragengine (webhooks, RBAC roles, services)
• go.mod

Reference

keda-kaito-scaler/cmd/app/manager.go — addCertificateControllers() demonstrates the cert-controller integration pattern.