[ci-scan] Test failure: NegotiateAuthenticationKerberosTest.Client_UnknownSPN_ReturnsTargetUnknown returns UnknownCredentials

### Description

`System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.Client_UnknownSPN_ReturnsTargetUnknown` failed on Alpine 3.24 arm64: expected `TargetUnknown`, actual `UnknownCredentials`.

This issue tracks only this test and this specific status mismatch, not all Kerberos or channel-binding failures. The underlying cause is unresolved; this is not classified as a confirmed infrastructure failure.

## Build Information

Build: [runtime 1591715](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1591715)
Build error leg or test failing: `linux_musl-arm64 checked CoreCLR_ReleaseLibraries` / `System.Net.Security.Tests`
Pull request: https://github.com/dotnet/runtime/pull/133639
Test result: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1591715&view=ms.vss-test-web.build-test-results-tab&runId=43936782&resultId=162038
Helix console: https://helix.dot.net/api/2019-06-17/jobs/a40b3316-de81-45c5-8c9e-013d84a12ab5/workitems/System.Net.Security.Tests/console

KBE authoring guidance (ci-failure-scan)

- `Error Details` is for readers. The exception and stack trace below identify the observed failure.
- Build Analysis parses only the single JSON block under `Error Message`.
- Each `ErrorMessage` array element is a case-sensitive literal substring copied from the failing console; elements match in order.
- `BuildRetry` is false because an infrastructure retry case has not been established. `ExcludeConsoleLog` is false to enable Helix console-log matching.

### Reproduction Steps

Observed in the linked CI run on September 10, 2026, running `System.Net.Security.Tests` on Alpine arm64. The test uses an in-process KDC and attempts Kerberos authentication to an unregistered SPN. No deterministic local reproduction is established.

### Expected behavior

`GetOutgoingBlob` reports `NegotiateAuthenticationStatusCode.TargetUnknown` for the unknown SPN.

### Actual behavior

The result is `NegotiateAuthenticationStatusCode.UnknownCredentials`; the assertion fails inside the RemoteExecutor child process.

## Error Details

```text
System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.Client_UnknownSPN_ReturnsTargetUnknown [FAIL]
Microsoft.DotNet.RemoteExecutor.RemoteExecutionException : Remote process failed with an unhandled exception.
Stack Trace:

Child exception:
Xunit.Sdk.EqualException: Assert.Equal() Failure: Values differ
Expected: TargetUnknown
Actual: UnknownCredentials
/_/src/libraries/System.Net.Security/tests/FunctionalTests/NegotiateAuthenticationKerberosTest.cs(103,0): at System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.<>c.b__4_0()
--- End of stack trace from previous location ---
/_/src/coreclr/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.CoreCLR.cs(37,0): at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args)
/_/src/libraries/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.cs(57,0): at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)

Child process:
System.Net.Security.Tests, Version=11.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51 System.Net.Security.Tests.NegotiateAuthenticationKerberosTest+<>c Void b__4_0()
```

The GSSAPI trace shows initial credential acquisition, a UDP request/reply with the local KDC, and destruction of the credential cache. It does not reach the expected unknown-service TGS request. The child-process abort follows the managed assertion; it is not evidence of an unexplained native crash.

## Error Message

```json
{
"ErrorMessage": [
"System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.Client_UnknownSPN_ReturnsTargetUnknown [FAIL]",
"Expected: TargetUnknown",
"Actual: UnknownCredentials"
],
"ErrorPattern": "",
"BuildRetry": false,
"ExcludeConsoleLog": false
}
```

Agentic workflow metadata (ci-failure-scan)

Workflow artifact: ci-failure-scan
Artifact kind: kbe-verification
Verified match count: 1 hits in failure.log

Verified against the linked original Helix console. Array-element counts are 1, 2, and 2; the ordered match is at lines 46, 52, and 53. No element matches a PASS or SKIP line. Filed interactively at the user's request.

### Regression?

Unknown. This exact test passes in an earlier main [build 1591508](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1591508) using the same Alpine container digest. PR #133639 changes CoreLib trimming substitutions and RuntimeFeatureTests rather than authentication code, so this failure appears independent, but an exact matching failure on main has not been established.

### Known Workarounds

None established. No test quarantine or CI rerun is requested by this issue.

### Configuration

.NET 11; Alpine 3.24 arm64; `linux_musl-arm64 checked CoreCLR_ReleaseLibraries`.

Container: `mcr.microsoft.com/dotnet-buildtools/prereqs:alpine-3.24-helix-arm64v8@sha256:7229985457fd1fb60afe60d1550bc9ccf93c5d54d3429aba079f4de6a7ffe7cf`.

Only this configuration is confirmed for this exact failure; platform specificity is unknown.

### Other information

Related: #132994 reports `ChannelBindings_Matching_Unique_Succeeds` returning `UnknownCredentials` instead of `Completed` on Debian 13 arm32 in main build 1574201 (August 30). That is a different test/platform and is not evidence of an identical root cause. This KBE intentionally does not match that broader failure family.

> [!NOTE]
> This issue was generated with GitHub Copilot assistance.

### Known issue validation
**Build: :mag_right:** https://dev.azure.com/dnceng-public/public/_build/results?buildId=1591715
**Error message validated:** `[System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.Client_UnknownSPN_ReturnsTargetUnknown [FAIL] Expected: TargetUnknown Actual: UnknownCredentials`]
**Result validation:** :white_check_mark: Known issue matched with the provided build.
**Validation performed at:** 9/11/2026 2:53:07 AM UTC

### Report

|Build|Repository|Test|Pull Request|
|---|---|---|---|
|[1591715](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1591715)|dotnet/runtime|[System.Net.Security.Tests.NegotiateAuthenticationKerberosTest.Client_UnknownSPN_ReturnsTargetUnknown](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1591715&view=ms.vss-test-web.build-test-results-tab&runId=43936782&resultId=162038)|dotnet/runtime#133639|
#### Summary
|24-Hour Hit Count|7-Day Hit Count|1-Month Count|
|---|---|---|
|0|1|1|

Start with NegotiateAuthenticationKerberosTest.cs at the Client_UnknownSPN_ReturnsTargetUnknown assertion on line 103, then inspect the test's in-process KDC setup and GetOutgoingBlob result. Run the focused System.Net.Security test on Alpine 3.24 arm64 if possible; done means the unknown-SPN case reliably reports TargetUnknown without the assertion failure.

Written by the indexing model from the issue text.