Canary kept-live test

Validates that a first deploy stays live when its TLS cert can't issue.