test(e2e): wait for CA issuance before copying its secret

The gateway-accepted test created a cert-manager CA Certificate and immediately
copied its secret into envoy-gateway-system, racing issuance. On slow runners the
secret didn't exist yet, failing with "secrets <name> not found / no objects
passed to apply" and flaking the suite. Assert the Certificate is Ready first.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: scotwells

test/e2e/gateway/chainsaw-test.yaml

@@ -56,6 +56,22 @@ spec:
                 ca:
                   secretName: ($clusterIssuerName)
 
+        # Wait for cert-manager to issue the CA before the script copies its
+        # secret. Without this, the copy races issuance and intermittently fails
+        # with "secrets <name> not found / no objects passed to apply".
+        - assert:
+            cluster: nso-infra
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: (join('-', [$clusterIssuerName, 'ca']))
+                namespace: cert-manager
+              status:
+                conditions:
+                  - type: Ready
+                    status: "True"
+
         - script:
             # skipCommandOutput: true
             # skipLogOutput: true