test(smoke): poll the control socket for the certificate check

After the post-config daemon restart Unit's controller (which serves the
control socket) can come up a moment after the router that already
answered the HTTP request, so a single probe of /certificates/<name> was
racy and failed intermittently on CI runners (8.4/8.5 red, 8.3 green by
luck). Poll for up to 30s, mirroring the HTTP readiness wait above.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: 6RUN0

test/smoke.sh

@@ -175,11 +175,23 @@ fi
 echo "==> *.sh executed (marker: $script_out)"
 
 # *.pem: assert the entrypoint uploaded the bundle, visible via the control API.
+# The control socket is served by Unit's controller, which after the post-config
+# daemon restart can come up a moment later than the router that already answered
+# the HTTP request above, so poll instead of probing once (otherwise flaky on a
+# slow runner).
 if [ -n "$cert_check" ]; then
     echo "==> verifying the entrypoint uploaded the *.pem certificate bundle"
-    if ! docker exec "$CONTAINER" curl -fsS -o /dev/null \
-        --unix-socket /var/run/control.unit.sock \
-        "http://localhost/certificates/$CERT_NAME" 2>/dev/null; then
+    cert_ok=
+    for _ in $(seq 1 30); do
+        if docker exec "$CONTAINER" curl -fsS -o /dev/null \
+            --unix-socket /var/run/control.unit.sock \
+            "http://localhost/certificates/$CERT_NAME" 2>/dev/null; then
+            cert_ok=1
+            break
+        fi
+        sleep 1
+    done
+    if [ -z "$cert_ok" ]; then
         echo "FAIL: certificate '$CERT_NAME' not retrievable from the control API" >&2
         echo "---- container logs ----" >&2
         docker logs "$CONTAINER" >&2 || true