flaky test: TestValidate_OIDC_KeyRotation_RefreshOnUnknownKid fails intermittently in CI #1381

Unit Tests failed on main run 904e993 with:

validator_test.go:456: kid B (post-rotation): scheduledauth: unauthorized: failed to verify signature

in TestValidate_OIDC_KeyRotation_RefreshOnUnknownKid (internal/server/scheduledauth). The test passes 5/5 locally at the same commit, and no recent merge touched the JWKS rotation logic (only comment/lint-level changes in the package), so this is a timing-sensitive flake in the post-rotation kid-refresh path (likely a race between the rotation swap and the refresh-on-unknown-kid fetch against the httptest JWKS server).

Fix properly per the no-sleep rule: synchronize the rotation with the validator's refresh (channel/Swap-then-signal), not a retry/sleep. Failed CI run: 29515xxx series on main (job 87679827193).