Monitoring OIDC mode swap from inline to secretRef has no test coverage #3785

Nothing covers a running monitoring release changing spec.oidc from customConfig inline config to secretRef. Both end states are pinned in packages/system/monitoring/tests/oidc_test.yaml, the transition between them is not.

This is the one open item from the ledger in #3778, which deleted hack/e2e-apps/monitoring-oidc-customconfig.bats. That file had a test doing the swap in place on a live release, and it never ran because no runner invoked that directory, so it was not real coverage either. It was the only thing pointing at the gap.

What it would catch happens at upgrade time and not at render time, inner HR keeping the previous auth.generic_oauth config while the new volume mount arrives, or the old -oidc-client Secret left behind after the mode no longer needs it. Render tests cannot see any of that.

Cost is why I did not add it in #3778. The swap needs the inner release to converge first and flux serialises operations on one HR with timeout: 15m, so a chainsaw suite doing this is around 10 to 15 minutes on every full e2e run. Worth deciding if that is the right price before someone writes it.