mTLS handshake succeeds to the proxy but upstream certificate pinning breaks only on one path

The edge trust path looks correct, yet the service still fails because an internal hop enforces a different certificate identity contract.