Fix v3 mode install and migration docs

Add the missing v1 CRD install step to the Calico quickstart, add the
custom-resources.yaml step to the native v3 CRD manifest install flow,
and call out the MutatingAdmissionPolicy feature gate as a prereq for
migration from API server mode.

Author: caseydavenport

calico/getting-started/kubernetes/quickstart.mdx

@@ -94,7 +94,13 @@ In this step, you will:
 
 In this step, you will install Calico in your cluster.
 
-1. Install the Tigera Operator and custom resource definitions.
+1. Install the $[prodname] custom resource definitions.
+
+   ```bash
+   kubectl create -f $[manifestsUrl]/manifests/v1_crd_projectcalico_org.yaml
+   ```
+
+2. Install the Tigera Operator.
 
    ```bash
    kubectl create -f $[manifestsUrl]/manifests/tigera-operator.yaml
@@ -110,7 +116,7 @@ In this step, you will install Calico in your cluster.
    deployment.apps/tigera-operator created
    ```
 
-2. Install $[prodname] by creating the necessary custom resources.
+3. Install $[prodname] by creating the necessary custom resources.
 
    ```bash
    kubectl create -f $[manifestsUrl]/manifests/custom-resources.yaml
@@ -123,7 +129,7 @@ In this step, you will install Calico in your cluster.
    whisker.operator.tigera.io/default created
    ```
 
-3. Monitor the deployment by running the following command:
+4. Monitor the deployment by running the following command:
 
    ```bash
    watch kubectl get tigerastatus

calico/operations/crd-migration.mdx

@@ -53,6 +53,7 @@ The locked window is typically short (seconds to a few minutes depending on clus
 
 - $[prodname] v3.32+ (or the release that includes the migration controller)
 - Cluster is currently running in API server mode (the aggregated API server is deployed)
+- The `MutatingAdmissionPolicy` [feature gate](https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/) must be enabled on the Kubernetes API server before starting the migration. Native `projectcalico.org/v3` CRDs rely on MutatingAdmissionPolicies for defaulting, which are currently a **beta** Kubernetes feature and are not enabled by default.
 - **If using GitOps (ArgoCD, Flux):** pause sync before starting the migration. These tools may interfere with the API group switchover. You'll update your manifests to use `projectcalico.org/v3` after migration completes.
 
 ## How to

calico/operations/native-v3-crds.mdx

@@ -106,12 +106,18 @@ Select the method below based on your preferred installation method.
 
    :::
 
-1. Install the Tigera Operator and custom resources:
+1. Install the Tigera Operator:
 
    ```bash
    kubectl create -f $[manifestsUrl]/manifests/tigera-operator.yaml
    ```
 
+1. Install $[prodname] by creating the necessary custom resources:
+
+   ```bash
+   kubectl create -f $[manifestsUrl]/manifests/custom-resources.yaml
+   ```
+
 </TabItem>
 </Tabs>