test(helm): match CA volumes by name

[elezar]

Summary

Make the existing OIDC CA and gateway client CA Helm tests insensitive to unrelated volume insertion. The assertions now identify volumes and mounts by name while preserving coverage of secret names, key mappings, mount paths, and omission behavior.

Related Issue

Related to #1868. This is a generally applicable test cleanup extracted from the HA review.

Changes

• Replace positional OIDC CA volume and volume-mount checks with name-based contains assertions.
• Replace positional client CA secret checks with exact named-volume assertions, including the ca.crt item mapping.
• Keep the separate client CA case exact so secret.items must remain absent.
• Replace the brittle expected volume count with name-based notContains checks for the HTTPS-only omission case.

Testing

• mise run pre-commit passes (run inside nix develop)
• Unit tests added/updated
• E2E tests added/updated (not applicable)

Focused validation:

• mise run helm:test — 62 tests passed across 5 suites
• mise run helm:lint — defaults and every CI values variant passed

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable; test-only change)

Notes

PR #2235 also touches these test files for a client CA behavior fix. It does not implement this assertion cleanup, but merge order may require a trivial rebase.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[elezar]

gator-agent

PR Review Status

Validation: This maintainer-authored PR is project-valid as a small, concentrated Helm test cleanup. It replaces brittle positional CA volume assertions with name-based checks while preserving coverage for OIDC CA mounts, client CA secret names, ca.crt item mappings, mount paths, and omission behavior.
Head SHA: dc6b0ff50908b7ccc5f569089fef906d86ab4fb2

Review findings:

• No blocking findings remain. The independent reviewer reported NO_BLOCKING_FINDINGS for the current head.

Docs: Not needed because this is test-only and does not change user-facing behavior or Fern documentation paths.

Checks: DCO and Helm Lint are green. Required Branch Checks are currently failing on Rust (linux-arm64-cpu8) in multiplex::tests::request_id_appears_in_trace_span under crates/openshell-server/src/multiplex.rs, which is outside this PR's Helm test changes.

E2E: Not required; no test:* label is needed for this Helm unit-test-only change.

Next state: gator:blocked

Blocker: required Branch Checks are red due to an unrelated Rust arm64 test failure. Next action: a maintainer should rerun or investigate that required check; once it is green, gator can continue to approval gating.