/certs mount reads every Let's Encrypt file and is too strict on permissions

## What

/certs mount: 2026.5 reads every Let’s Encrypt file and the worker is overly strict about certs permissions.

## Want

- /certs mount: 2026.5 reads every Let’s Encrypt file
- The worker is overly strict about certs permissions

## Ideas this came from

- [#22639 2026.5.0 Let's Encrypt into /certs folder, all files being read](https://github.com/goauthentik/authentik/issues/22639) — When importing a Let's Encrypt (etc/letsencrypt) folder into the /certs folder via a docker-compose file, all files are being scanned for .pem format and are ca
- [#22807 Authentik Worker - Permission Issue - Stop being control Freaks for /certs Mountpoint](https://github.com/goauthentik/authentik/issues/22807) — After upgrading to Authentik 2026.5.2, I am getting Error: Permission denied (os error 13), most likely (although difficult to tell since there is no clear Log

Start by tracing the /certs mount handling and the worker’s certificate discovery and permission checks, using linked issues #22639 and #22807 as behavioral context. Reproduce with a Let’s Encrypt directory containing non-PEM files and restricted certificate permissions; done means intended files are read without unrelated files or valid mounts being rejected.

Written by the indexing model from the issue text.