A cert-manager DNS01 renewal works in staging and fails in production

Credentials exist, yet the hardened runtime path cannot read the projected token at the path the solver image expects.