A cert-manager renewal passes staging and fails production

The certificate request reaches the solver, yet the runtime class change quietly removed the credentials path needed for the real DNS update.