fix: certwatcher reloads in poll-only mode when fsnotify setup is slow/fails

[matteogastaldello]

Problem

pkg/certwatcher intermittently fails in CI, e.g.:

[FAIL] CertWatcher ... [It] should get updated on read certificate errors
[FAILED] Timed out after 10.001s.
[AfterSuite] [PANICKED] ... Start(ctx) returned an error

Root cause is in production code, not just the test. Start() added the
fsnotify watches before entering the poll loop, using
PollUntilContextTimeout(..., 10s, ...), and returned an error if the
watches could not be added in time. So:

1. The periodic poll — the baseline reload mechanism — never ran until
   fsnotify was set up.
2. A slow or failing watch setup disabled certificate reloading entirely
   (Start returned an error and exited).

Under CI load the watch setup can take ~10s, so no certificate read happened in
the test's window (the read_certificate_total metric never incremented) and
Start returned an error → the timeout + AfterSuite panic.

Fix

Production (certwatcher.go). Start now launches the poll loop
immediately and adds the fsnotify watches in the background (watchFiles),
retrying until they are added or the context is cancelled. fsnotify stays an
optimization; the watcher keeps working in poll-only mode until (and if) the
watches come up, and a watch-setup failure no longer disables reloading or fails
Start.

Tests (certwatcher_test.go). Make the affected tests use a 1s poll
interval and Eventually timeouts comfortably above it, so assertions no longer
depend on fsnotify delivery timing:

• should reload currentCert when changed
• should reload currentCert when changed with rename
• should get updated on read certificate errors

Verification

go build ./..., go vet, gofmt clean. 15 consecutive runs of
go test ./pkg/certwatcher/ plus two -race runs, all green.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 60.00000% with 6 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/certwatcher/certwatcher.go	60.00%	5 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!