Watch the first Envoy cert renewal (~2026-07-17)

**Nobody has ever seen a certificate renew on the Envoy `gatewayHTTPRoute` path.** Every gateway cert in both clusters is a first issuance.

Sandbox's certs expire **2026-08-16**, so cert-manager starts renewing them around **2026-07-17** — three days out. That makes sandbox a free canary for live, whose renewals don't land until October.

This matters because live just had nine certs expire silently ([cfp-live-cluster#144](https://github.com/CodeForPhilly/cfp-live-cluster/issues/144)) — the failure mode is quiet by default, and if the renewal path has a flaw we want to find it here, in sandbox, in July, not in live in October.

## Check on ~2026-07-17

```bash
export KUBECONFIG=~/.kube/cfp-sandbox-cluster-kubeconfig.yaml
kubectl get certificate -A # notAfter should move to ~Nov
kubectl get challenges -A # should be empty; anything pending >1h is a problem
```

If a Challenge sits `pending`, or a Certificate sticks on `Issuing`, treat it as urgent — it's the same class of silent failure that took out live.

On or around 2026-07-17, use the sandbox kubeconfig and run `kubectl get certificate -A` and `kubectl get challenges -A`. Confirm certificate `notAfter` dates advance to roughly November and that no Challenge remains pending for over an hour or Certificate remains Issuing.

Written by the indexing model from the issue text.