#20 fix(provenance): start the managed webhook server

The provider provenance webhook stays unready because its configured server is never added to the controller-runtime manager. The health probe starts, but the TLS listener does not, leaving readiness reporting webhook server has not been started yet.

Register the admission handler through mgr.GetWebhookServer() so the manager starts and stops the configured TLS server. Keep the existing validation, certificate configuration and readiness check.