mTLS looks correct on paper but one client still fails

One client runtime connects successfully while another fails against the same upstream despite using the same trusted root set.