test(api): add envtest cases for servingCerts CEL has() guards

Add two additional envtest cases to exercise each has() guard
added in the servingCerts CEL validation fix:

- servingCerts present but no namedCertificates: exercises
  has(self.configuration.apiServer.servingCerts.namedCertificates)
- namedCertificates entry with no names field: exercises
  has(cert.names)

Signed-off-by: rutvik23 <rkshirsa@redhat.com>
Commit-Message-Assisted-by: Claude (via Claude Code)

Author: rutvik23

cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/stable.hostedclusters.services.testsuite.yaml

@@ -288,4 +288,93 @@ tests:
         configuration:
           apiServer:
             additionalCORSAllowedOrigins:
-            - "https://example.com"
+            - "https://example.com"
+
+  - name: When loadBalancer hostname is set and apiServer has servingCerts but no namedCertificates it should pass
+    initial: |
+      apiVersion: hypershift.openshift.io/v1beta1
+      kind: HostedCluster
+      spec:
+        dns:
+          baseDomain: example.com
+        platform:
+          type: AWS
+        pullSecret:
+          name: secret
+        release:
+          image: quay.io/openshift-release-dev/ocp-release:4.15.11-x86_64
+        secretEncryption:
+          aescbc:
+            activeKey:
+              name: key
+          type: aescbc
+        services:
+        - service: APIServer
+          servicePublishingStrategy:
+            type: LoadBalancer
+            loadBalancer:
+              hostname: kas.example.com
+        - service: Ignition
+          servicePublishingStrategy:
+            type: NodePort
+            nodePort:
+              address: "127.0.0.1"
+        - service: Konnectivity
+          servicePublishingStrategy:
+            type: NodePort
+            nodePort:
+              address: "fd2e:6f44:5dd8:c956::14"
+        - service: OAuthServer
+          servicePublishingStrategy:
+            type: NodePort
+            nodePort:
+              address: "fd2e:6f44:5dd8:c956:0000:0000:0000:0014"
+        configuration:
+          apiServer:
+            servingCerts: {}
+
+  - name: When loadBalancer hostname is set and namedCertificates entry has no names it should pass
+    initial: |
+      apiVersion: hypershift.openshift.io/v1beta1
+      kind: HostedCluster
+      spec:
+        dns:
+          baseDomain: example.com
+        platform:
+          type: AWS
+        pullSecret:
+          name: secret
+        release:
+          image: quay.io/openshift-release-dev/ocp-release:4.15.11-x86_64
+        secretEncryption:
+          aescbc:
+            activeKey:
+              name: key
+          type: aescbc
+        services:
+        - service: APIServer
+          servicePublishingStrategy:
+            type: LoadBalancer
+            loadBalancer:
+              hostname: kas.example.com
+        - service: Ignition
+          servicePublishingStrategy:
+            type: NodePort
+            nodePort:
+              address: "127.0.0.1"
+        - service: Konnectivity
+          servicePublishingStrategy:
+            type: NodePort
+            nodePort:
+              address: "fd2e:6f44:5dd8:c956::14"
+        - service: OAuthServer
+          servicePublishingStrategy:
+            type: NodePort
+            nodePort:
+              address: "fd2e:6f44:5dd8:c956:0000:0000:0000:0014"
+        configuration:
+          apiServer:
+            servingCerts:
+              namedCertificates:
+              - servingCertificate:
+                  name: my-cert