A cert-manager Certificate stays Pending (http01-solver-ingress-forced-to-https-by-global-annotation)

Issuance config looks valid, yet the challenge never completes because the temporary ingress path is altered by a cluster-wide redirect behavior.