Fix Traefik restart and ACME reliability

[arjunkomath]

Summary

• keep Prometheus bucket values stable across YAML round trips so dynamic reconciliation does not trigger false static-config restarts
• wait for Traefik metrics readiness after required restarts instead of sleeping for a fixed two seconds
• retry rollout certificate issuance three times with durable 10-second and 20-second Inngest backoff

Testing

• cd agent && go test ./internal/traefik -run 'TestEnsurePrometheusMetricsConfig|TestWaitForMetricsReady|TestEnsureDynamicConfigReloaded|TestWaitForSuccessfulReloadAfter'\n- cd agent && go test ./internal/agent\n- cd agent && TMPDIR="$(cd "$TMPDIR" && pwd -P)" go test ./...\n- cd agent && go build ./...\n- cd agent && test -z "$(gofmt -l .)"\n- cd web && pnpm test (69 files, 505 tests)\n- cd web && ./node_modules/.bin/tsc --noEmit\n- cd web && pnpm lint (0 errors; 7 unrelated existing warnings)\n\n## Local macOS note\n\nThe default logical /var/... temp path exposes an existing registryauth path-canonicalization bug in TestManagerInstallDirtyAndPermissions. agent/internal/registryauth is unchanged in this PR; the complete Go suite passes when TMPDIR uses its equivalent physical /private/var/... path.

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit dd89d31.}