cert-manager renews the Secret, but the mounted Java keystore never reloads and TLS clients keep seeing the expired chain

The cluster certificate resource is healthy, yet the workload runtime still serves stale credentials from an application-level cache.