Same fix as flux-system: Traefik needs to reach the cert-manager ACME HTTP-01 solver pod on port 8089 for TLS certificate issuance.