Mutual TLS works on primary path but fails after east-west failover

Certificates and policies look valid, but the fallback service path presents a different trust context and breaks authentication.