mTLS breaks only on rotated clients

A certificate rollout follows community guidance and appears fine on servers. Client auth still fails on one path because not every validator tier received the new intermediate bundle.