A cert-manager DNS01 renewal passes staging and fails production

The token exists, yet the challenge helper can no longer read it once the stricter runtime class is applied in production.