test(helm): match CA volumes by name

[elezar]

Summary

Make the existing OIDC CA and gateway client CA Helm tests insensitive to unrelated volume insertion. The assertions now identify volumes and mounts by name while preserving coverage of secret names, key mappings, mount paths, and omission behavior.

Related Issue

Related to #1868. This is a generally applicable test cleanup extracted from the HA review.

Changes

• Replace positional OIDC CA volume and volume-mount checks with name-based contains assertions.
• Replace positional client CA secret checks with exact named-volume assertions, including the ca.crt item mapping.
• Keep the separate client CA case exact so secret.items must remain absent.
• Replace the brittle expected volume count with name-based notContains checks for the HTTPS-only omission case.

Testing

• mise run pre-commit passes (run inside nix develop)
• Unit tests added/updated
• E2E tests added/updated (not applicable)

Focused validation:

• mise run helm:test — 62 tests passed across 5 suites
• mise run helm:lint — defaults and every CI values variant passed

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable; test-only change)

Notes

PR #2235 also touches these test files for a client CA behavior fix. It does not implement this assertion cleanup, but merge order may require a trivial rebase.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.