fix(ingress/legacy): drop cluster_issuer_override fallback (not supported on legacy)

Legacy only sets the DNS-01 issuer (gts-production) when private; otherwise null.
No user-facing cluster_issuer_override input, so don't read it from spec.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sanmesh-kakade

modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf

@@ -55,7 +55,7 @@ locals {
   # Private LB → HTTP-01 can't validate an internal NLB; issue certs via the
   # gts-production DNS-01 ClusterIssuer instead. No effect in acm_mode (NLB
   # terminates TLS with the ACM cert, no cert-manager involvement).
-  cluster_issuer_override = lookup(var.instance.spec, "private", false) && !local.acm_mode ? "gts-production" : lookup(var.instance.spec, "cluster_issuer_override", null)
+  cluster_issuer_override = lookup(var.instance.spec, "private", false) && !local.acm_mode ? "gts-production" : null
 
   modified_instance = merge(var.instance, {
     spec = merge(var.instance.spec, {

modules/ingress/nginx_gateway_fabric_legacy_azure/1.0/main.tf

@@ -23,7 +23,7 @@ locals {
 
   # Private LB → HTTP-01 can't validate an internal LB; issue certs via the
   # gts-production DNS-01 ClusterIssuer instead.
-  cluster_issuer_override = lookup(var.instance.spec, "private", false) ? "gts-production" : lookup(var.instance.spec, "cluster_issuer_override", null)
+  cluster_issuer_override = lookup(var.instance.spec, "private", false) ? "gts-production" : null
 
   modified_instance = merge(var.instance, {
     spec = merge(var.instance.spec, {

modules/ingress/nginx_gateway_fabric_legacy_gcp/1.0/main.tf

@@ -25,7 +25,7 @@ locals {
 
   # Private LB → HTTP-01 can't validate an internal LB; issue certs via the
   # gts-production DNS-01 ClusterIssuer instead.
-  cluster_issuer_override = lookup(var.instance.spec, "private", false) ? "gts-production" : lookup(var.instance.spec, "cluster_issuer_override", null)
+  cluster_issuer_override = lookup(var.instance.spec, "private", false) ? "gts-production" : null
 
   modified_instance = merge(var.instance, {
     spec = merge(var.instance.spec, {