reissue-certificates ran clean but ovn-central still has ca+client.cert only, no
server cert -- not a timing issue. Confirmed known upstream bug charm-ovn-central
LP #2044324 (New/Undecided, no fix): ovn-central iterates internal/admin/public
endpoint spaces for its cert SANs, finds no local address (our bundle binds
nothing to those endpoint types), so the server-cert request never completes.
BUILDOUT-mode charm gap, not a deploy error. Candidate remedies logged (juju
bind the endpoint spaces / escalate the LP / accept degraded and assess blast
radius). Awaiting operator direction.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf