ci: capture pod events + cert-manager health in e2e diagnostics

The upstream manager hangs in ContainerCreating waiting on a secret; the
prior diagnostics only dumped pod lists and container logs, which are
empty for a container that never started. Add describe output for
not-ready pods and cert-manager restart/issuance state so the mount
failure is visible from the run log.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JbCy8vy66RdNYzGSgqH6P6

Author: scotwells

.github/workflows/test-e2e-federated.yml

@@ -91,6 +91,22 @@ jobs:
           echo "::group::downstream pods"
           kubectl --context kind-nso-downstream get pods -A -o wide
           echo "::endgroup::"
+          echo "::group::not-ready pods — describe (both clusters)"
+          for ctx in kind-nso-upstream kind-nso-downstream; do
+            echo "### $ctx"
+            kubectl --context "$ctx" get pods -A \
+              --field-selector=status.phase!=Running,status.phase!=Succeeded -o name | while read -r p; do
+              ns=$(kubectl --context "$ctx" get "$p" -A -o jsonpath='{..metadata.namespace}' 2>/dev/null)
+              kubectl --context "$ctx" -n "$ns" describe "${p#*/}" 2>/dev/null | tail -30
+            done
+          done
+          echo "::endgroup::"
+          echo "::group::cert-manager health (upstream) — restarts + issuance"
+          kubectl --context kind-nso-upstream -n cert-manager get pods -o wide
+          kubectl --context kind-nso-upstream -n cert-manager \
+            logs -l app.kubernetes.io/name=cert-manager --tail=80 --previous 2>/dev/null || true
+          kubectl --context kind-nso-upstream get certificate,certificaterequest,issuer,clusterissuer -A
+          echo "::endgroup::"
           echo "::group::karmada member clusters"
           KCFG=/tmp/karmada-nso-upstream/karmada-apiserver.config
           kubectl --kubeconfig "$KCFG" --context karmada-apiserver get clusters -o wide