Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

Fix certificate rotation race condition in per-node certificates

Handle transient certificate errors during daemon startup to prevent
crash-loops when pods restart during the certificate rotation window
(~3 seconds) where the symlink is temporarily removed or the file is
empty.

Changes:
- Add isTransientCertError() to classify errors as transient vs permanent
  using string matching (the cert store wraps errors with %v, destroying
  type information, so errors.As is ineffective here)
- Transient errors (file not found, empty/invalid PEM) return (false, nil)
  in the existing 1-second poll, retrying naturally
- Permanent errors (NoCertKeyError) now propagate via (false, err) to
  fail fast instead of polling for the full 2-minute timeout
- Add unit tests for isTransientCertError covering all error cases

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Benjamin Pickard <bpickard@redhat.com>