docs(chart): surface tlsVerify in NOTES + artifacthub changes

NOTES.txt now mentions both TLS-enable paths (CA bundle for
self-signed/private, tlsVerify for public CAs) and only warns when
neither is set.

artifacthub.io/changes annotation updated to describe the v0.4.1
addition so the chart listing reflects what actually changed.

Author: Varashi

chart/Chart.yaml

@@ -26,4 +26,4 @@ annotations:
   artifacthub.io/license: MIT
   artifacthub.io/changes: |
     - kind: added
-      description: Initial Helm chart release.
+      description: VCENTER_TLS_VERIFY / vcenter.tlsVerify for public-CA vCenter certs.

chart/templates/NOTES.txt

@@ -10,11 +10,12 @@ ExternalSecretsOperator), or populate `vcenter.host`, `vcenter.user`, and
 `vcenter.password` and the chart will render an inline Secret for you.
 {{- end }}
 
-{{- if not .Values.vcenter.caBundle.configMapName }}
+{{- if and (not .Values.vcenter.caBundle.configMapName) (not .Values.vcenter.tlsVerify) }}
 
-Note: vCenter TLS verification is DISABLED. To enable, create a ConfigMap
-containing your vCenter / issuing CA bundle (PEM) and set
-`vcenter.caBundle.configMapName` + `vcenter.caBundle.key`.
+Note: vCenter TLS verification is DISABLED. To enable, pick one:
+  - Self-signed or private CA: create a ConfigMap with your CA bundle (PEM)
+    and set `vcenter.caBundle.configMapName` + `vcenter.caBundle.key`.
+  - Public CA (Let's Encrypt, DigiCert, etc.): set `vcenter.tlsVerify: true`.
 {{- end }}
 
 Verify the controller is running: