Constant MISSING_CA_BUNDLE_REASON 

pub const MISSING_CA_BUNDLE_REASON: &str = "MissingCaBundle";

reason/Event reason for CREDENTIALS_AVAILABLE_CONDITION = False when the missing dependency is the backend’s tls.caBundleRef ConfigMap (or its key): the PEM CA bundle the mover needs to verify a private-CA S3 endpoint. The user creates it; a ConfigMap that never appears never self-heals, so this is a structural gate (crate::gates::MISSING_CA_BUNDLE_GATE), not just a transient retry.