A mutual TLS edge validates the client certificate

Transport trust succeeds and application authorization still breaks. The service still works through the primary path, but one dependency only fails when the old component is finally drained away.