k8s-ingress-tls-audit — catch broken Ingress TLS before it 502s

Scan Kubernetes Ingress resources for TLS misconfiguration — missing tls blocks, uncovered hosts, missing cert secrets, and expiring certs — from a live cluster or manifests, with a CI-gating exit code.