Fix KIND cluster setup: CA cert injection, --no-argocd flag, and help command

[ajfloeder]

Summary

Improves tools/kind.sh for local KIND cluster development workflows.

Changes

• --no-argocd flag: Added a --no-argocd option to create (and reset) that deploys using the legacy overlay instead of ArgoCD, useful for quick local testing without a gitops repo.

• Corporate CA cert injection: On macOS, automatically exports certs from System.keychain and injects them into all KIND nodes on cluster creation. This is a no-op on machines without a corporate TLS proxy (e.g. Zscaler). Fixes image pull failures through corporate MITM proxies.

• Test user creation: Added create_test_user to create the flux user (UID=1051, GID=1052) on Rabbit worker nodes during cluster creation, satisfying the nnf-integration-test BeforeSuite check.

• --help / help command: Added --help flag and help subcommand that print usage information. Moved usage() before the option-parsing loop so --help works at parse time.

• reset note in help: Added a note in the reset command description reminding users that locally-built images are not automatically reloaded into the new cluster — they need to re-run push or ./nnf-deploy make kind-push after a reset.