test(mariadb): cover every issuer state the projection claims to ignore

The case titled "renders regardless of tls.issuer" set issuer: operator,
which is the chart default, so both sides of its claim were the same
side. Hiding the sentinel behind the cert-manager gate — the one edit
the title rules out — left it green.

Being ungated is the projection's entire contract, so each state is now
its own case: the default, operator, cert-manager, and an explicit null,
which the issuer helper treats as unset rather than as a spelling of the
default.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>

packages/apps/mariadb/tests/tenant_projection_test.yaml

@@ -57,8 +57,16 @@ tests:
 
   # Ungated: unlike nats/qdrant, TLS is always served here (see the tls.issuer
   # discussion in the README), so the source Secret exists for every release
-  # regardless of tls.issuer.
-  - it: renders regardless of tls.issuer
+  # regardless of tls.issuer. Being ungated is the projection's whole contract,
+  # so every issuer state is spelled out. One case setting the chart default
+  # would assert the same branch the cases above already cover, and hiding the
+  # sentinel behind the cert-manager gate would still pass it.
+  - it: renders under the default issuer
+    asserts:
+      - hasDocuments:
+          count: 1
+
+  - it: renders under tls.issuer=operator
     set:
       tls:
         issuer: operator
@@ -66,6 +74,23 @@ tests:
       - hasDocuments:
           count: 1
 
+  - it: renders under tls.issuer=cert-manager
+    set:
+      tls:
+        issuer: cert-manager
+    asserts:
+      - hasDocuments:
+          count: 1
+
+  # The chart resolves the issuer through a helper that treats an explicit null
+  # as unset, so this is a third state rather than a spelling of the default.
+  - it: renders when tls is explicitly null
+    set:
+      tls: null
+    asserts:
+      - hasDocuments:
+          count: 1
+
   - it: renders the source and target names from the release, not a fixed string
     release:
       name: other-mariadb