mTLS resumes fine after certificate rotation on one service and fails on another

A rotation campaign updates bundles cluster-wide and only one workload or sidecar continues failing mutual TLS handshakes.