test(bdd): cover fail-closed Pylon TLS registration

[sbaum1994]

Why

Issue #1292 exposed fail-open and weakly observed Pylon registration behavior that the current BDD suite did not exercise. A successful happy-path invocation cannot prove that invalid trust, identity, or protocol inputs are rejected before registration.

Scope

Add tests/bdd/features/multi-cluster-helmfile-llm-registration-tls-fail-closed.feature as an outside-in local k3d test of Pylon TLS registration failure modes.

Acceptance criteria

• The feature independently exercises an untrusted root, missing trust material, hostname mismatch, plaintext-to-TLS, and invalid authority.
• Each client-side case observes rejection at the running TLS registration listener.
• Invalid authorities are rejected during stack rendering before a workload can start.
• Errors remain visible through workload status, logs, or metrics without inspecting implementation state.
• The feature has a live Godog entry point and a non-live wiring test.
• The feature is run destructively on local k3d against the relevant fix Pull Request SHAs.

Parent

Relates to #1292