feat: enable cert rotation for allocation API service (fixes #422)

[Copilot]

• Investigate CI unit test failure
• Identify root cause: race condition in port_registry_test.go parallel allocation blocks
• Fix both parallel allocation blocks to use atomic LoadOrStore for name deduplication
• Verify fix by running all 85 operator tests (66 controller + 10 webhook + 9 cert watcher)

---

⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.

[dgkanatsios]

@copilot can you check why the unit test failed? it's not because of this PR, wondering if there's a race condition bug somewhere

[Copilot]

@copilot can you check why the unit test failed? it's not because of this PR, wondering if there's a race condition bug somewhere

Yes, it's a pre-existing race condition in port_registry_test.go, not caused by this PR. The test "Random port registration on port registry with two thousand ports, five hundred on four nodes" had two bugs:

1. Second parallel allocation block (line 489-503) had no name deduplication at all — generateName(prefix) could produce a name that already existed in gameServerNamesAndPorts (from the first allocation round or from another goroutine), causing GetNewPorts to return "ports already assigned for this GameServer".

2. First parallel allocation block (line 434-438) had a TOCTOU race — two goroutines could both call Load(gameServerName), both see !ok, and both proceed with the same name. The first to reach GetNewPorts succeeds, the second gets "ports already assigned".

Fix: replaced both blocks with sync.Map.LoadOrStore() to atomically claim generated names, preventing duplicate registration. Commit 3c477a9.