fix(envd): stop misleading CA install cancel errors on rapid /init

[arkamar]

The orchestrator's /init retry loop uses short client timeouts. Since 83ee89f ("fix(envd): make CA install lock ctx-aware (#2690)") the foreground CA lock acquire respects the caller's ctx while a previous install's background cleanup goroutine holds the lock doing slow I/O. A rapid retry carrying the same cert blocked on that lock, had its request ctx canceled, and surfaced

Failed to set data: failed to install CA bundle: acquire CA install lock: context canceled

logged at Error, even though the install's background routine was still progressing.

Wrap that canceled acquire in a known sentinel (ErrCAInstallInProgress) so writeInitError can recognise it and log at Warn instead of Error, and return 503 (retryable) instead of 400.

[cursor]

PR Summary

Low Risk
Narrow change to error classification and HTTP status for contended CA installs; no change to cert installation logic itself.

Overview
Rapid orchestrator /init retries could hit a CA bundle install still waiting on the install lock (often because a prior install’s background cleanup holds it and the request context times out). Those cases were logged as hard failures and returned 400, even when work was still in progress.

Failed lock acquires are now wrapped with ErrCAInstallInProgress, so /init responds with 503 and a warning instead of an error, and a test covers canceled acquire under lock contention. envd is bumped to 0.6.8.

^{Reviewed by Cursor Bugbot for commit 4378947. Bugbot is set up for automated code reviews on this repo. Configure here.}

[gemini-code-assist]

Code Review

This pull request introduces a new error ErrCAInstallInProgress to handle cases where a CA certificate installation is already in progress. It updates the API's error handler to return a 503 Service Unavailable status code when this error occurs, and adds a corresponding unit test to verify this behavior under contention. The package version has also been bumped to 0.6.8. I have no feedback to provide as there are no review comments.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[codecov]

Codecov Report

❌ Patch coverage is 33.33333% with 4 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
packages/envd/internal/api/init.go	0.00%	4 Missing ⚠️

📢 Thoughts on this report? Let us know!