RHOAIENG-54714: Fix naive datetime comparison in certificate cleanup [cursor-generated]

Use timezone-aware UTC datetimes consistently in certificate cleanup
functions. cleanup_old_certificates() and list_tls_certificates() were
using naive local-time datetimes, while cleanup_expired_certificates()
correctly used UTC-aware datetimes. On non-UTC systems this caused
incorrect cutoff calculations and potential TypeError when comparing
aware vs naive datetimes.

Changes:
- list_tls_certificates(): use fromtimestamp(ts, tz=timezone.utc)
- cleanup_old_certificates(): use datetime.now(timezone.utc)
- Update tests to use UTC-aware datetimes consistently

Fix black formatting for fromtimestamp line wrap

Author: chipspeak

src/codeflare_sdk/common/utils/generate_cert.py

@@ -467,7 +467,9 @@ def list_tls_certificates():
 
             # Get directory stats
             stat_info = cert_dir.stat()
-            created = datetime.datetime.fromtimestamp(stat_info.st_ctime)
+            created = datetime.datetime.fromtimestamp(
+                stat_info.st_ctime, tz=timezone.utc
+            )
 
             # Calculate total size
             total_size = sum(
@@ -562,7 +564,7 @@ def cleanup_old_certificates(days=30, dry_run=True):
     """
     import shutil
 
-    cutoff_date = datetime.datetime.now() - datetime.timedelta(days=days)
+    cutoff_date = datetime.datetime.now(timezone.utc) - datetime.timedelta(days=days)
     old_certs = []
 
     certificates = list_tls_certificates()

src/codeflare_sdk/common/utils/test_generate_cert.py

@@ -478,7 +478,7 @@ def test_cleanup_expired_certificates_dry_run(mocker, tmp_path):
                 "cluster_name": "expired-cluster",
                 "namespace": "ns",
                 "path": str(cert_dir),
-                "created": datetime.datetime.now(),
+                "created": datetime.datetime.now(timezone.utc),
                 "size": 100,
                 "cert_expiry": expired_time,
             }
@@ -516,7 +516,7 @@ def test_cleanup_expired_certificates_delete(mocker, tmp_path):
                 "cluster_name": "expired-cluster",
                 "namespace": "ns",
                 "path": str(cert_dir),
-                "created": datetime.datetime.now(),
+                "created": datetime.datetime.now(timezone.utc),
                 "size": 100,
                 "cert_expiry": expired_time,
             }
@@ -533,6 +533,7 @@ def test_cleanup_old_certificates_dry_run(mocker, tmp_path):
     """Test cleanup_old_certificates in dry_run mode"""
     from codeflare_sdk.common.utils.generate_cert import cleanup_old_certificates
     import datetime
+    from datetime import timezone
 
     mocker.patch(
         "codeflare_sdk.common.utils.generate_cert._get_tls_base_dir",
@@ -545,7 +546,7 @@ def test_cleanup_old_certificates_dry_run(mocker, tmp_path):
     (cert_dir / "tls.crt").write_text("fake cert")
 
     # Mock list_tls_certificates to return an old cert
-    old_time = datetime.datetime.now() - datetime.timedelta(days=60)
+    old_time = datetime.datetime.now(timezone.utc) - datetime.timedelta(days=60)
     mocker.patch(
         "codeflare_sdk.common.utils.generate_cert.list_tls_certificates",
         return_value=[
@@ -570,6 +571,7 @@ def test_cleanup_old_certificates_delete(mocker, tmp_path):
     """Test cleanup_old_certificates actually deletes when dry_run=False"""
     from codeflare_sdk.common.utils.generate_cert import cleanup_old_certificates
     import datetime
+    from datetime import timezone
 
     mocker.patch(
         "codeflare_sdk.common.utils.generate_cert._get_tls_base_dir",
@@ -582,7 +584,7 @@ def test_cleanup_old_certificates_delete(mocker, tmp_path):
     (cert_dir / "tls.crt").write_text("fake cert")
 
     # Mock list_tls_certificates to return an old cert
-    old_time = datetime.datetime.now() - datetime.timedelta(days=60)
+    old_time = datetime.datetime.now(timezone.utc) - datetime.timedelta(days=60)
     mocker.patch(
         "codeflare_sdk.common.utils.generate_cert.list_tls_certificates",
         return_value=[