An Elastic agent starts fine and never enrolls

A trust bundle is rotated through symlink swaps and later one long-lived agent still rejects the same endpoint with old TLS errors.