Projected CA bundle on one namespace lags and only that team's jobs fail outbound TLS validation

Cluster TLS trust is mostly healthy, but one namespace still mounts an older CA bundle and its jobs reject the new upstream certificate path.