A trust bundle update reaches the API tier, but the sidecar envoy still pins the old bundle hash and east-west mTLS fails only there

Certificate distribution was mostly successful, yet one data-plane component still enforces the previous trust set.