test(redis): the null-namespace TLS test does not check that the external SAN is absent #4621

The redis test "leaf Certificate still renders with no external SAN when no namespace map is injected" checks only half of its name. It asserts that an in-cluster name is present, and nothing about the external name being absent (packages/apps/redis/tests/tls_test.yaml:692 at c983b5c).

So the test stays green if the chart emits a malformed external SAN such as my-redis. when _namespace is null. Today the chart does not, because a null _namespace goes through the same default dict and default "" path as an empty host, and the empty-host test right above it does assert the absence. The null case is simply not pinned on its own.

Fix: add the same notContains asserts the empty-host test carries (my-redis., plus my-redis.redis. once the per-engine SAN lands).