Document updating the trust bundle ConfigMap when rotating certs via kubectl

[MyMirelHub]

Description

The kubectl certificate-update steps under "Custom certificates (bring your own)" only update the dapr-trust-bundle Secret. The trust bundle also lives in a dapr-trust-bundle ConfigMap (public root cert), and Sentry validates the two as a pair: if the ConfigMap's ca.crt doesn't match the Secret's, Sentry discards the bundle and silently regenerates a self-signed 1-year CA, overwriting the user's certificates. This also breaks the section's zero-downtime promise whenever the root cert changes — even when signed with the same private key.

This PR restructures that passage into numbered steps (matching the sibling self-signed subsection):

1. Update the Secret (existing text, unchanged)
2. If the root cert changed, sync the same root into the ConfigMap (plain PEM, not base64) — with the command; issuer-only rotations under the existing root can skip this
3. A verification line after the Sentry restart with the exact log message that indicates the mismatch (Root and issuer certs not found: generating self signed CA), since the failure is otherwise silent

Only the manual-kubectl path is affected; Helm and dapr mtls renew-certificate update both objects atomically.

Issue reference

Fixes #5248

Checklist

• Followed the style and terminology guidance
• Verified against the Sentry behavior in pkg/sentry/server/ca/kube.go (v1.14.4 and master)

[marcduiker]

LGTM