fix(certificates): do not verify DNS again for a job the endpoint just verified - #13765

Option 1 of two: the explicit variant. Option 2 is cloud-only (appwrite-labs/cloud#5963) and infers the same thing from the rule's status. One of the two will be kept.

Problem

The proxy create endpoints and the re-verify endpoint run the multi-region DNS validator, write the rule as verifying, and enqueue generation. Seconds later the certificates worker ran the identical validator again. When both pass, that is doubled DNS traffic and latency for nothing. When the second run fails on a transient, the worker writes unverified with "DNS verification failed" on a rule the API just accepted, and the console contradicts itself. That flip is the only outcome the second check can produce that the first could not.

Change

• Appwrite\Event\Message\Certificate gets skipDomainValidation, default false, serialized with the rest. Jobs already in the queue when this ships carry no key and behave as before.
• The worker's generation path skips validateDomain when the flag is set. Unlike skipRenewCheck, the renew check stays in place, so an existing certificate is still reused rather than re-issued. That distinction matters for self-hosted Let's Encrypt, where a needless re-issue counts against rate limits.
• Every enqueuer that verified DNS itself sets the flag: the API, function, site and redirect rule create endpoints when the rule came out verifying, the re-verify endpoint, and the worker's own domain-verification action when it hands off to generation.

Not set by maintenance renewals, the SSL task, the main-domain bootstrap, or the auto-issue path for Appwrite-owned subdomains, none of which verified anything first. The worker's DNS check still runs for all of them.

If the DNS really did change between the endpoint's check and the job, the provider's own challenge does not complete and the status stays pending; nothing is issued for a domain that does not point at the instance.

Tests

• tests/unit/Event/Message/CertificateTest.php: the flag round-trips through the queue payload with the renew check untouched, and a payload from before the flag reads as false.
• tests/unit/Workers/CertificatesDomainValidationTest.php drives the worker's public action with a domain under a TLD no public suffix list knows, which the DNS check refuses before touching the network, so the tests observe whether the check ran: with the flag the job reaches issueCertificate and the rule stays verifying; with the flag and no renewal needed nothing is issued and the rule still stays verifying; without the flag the job never reaches issuance and the rule is written unverified.

composer lint passes. PHPStan passes on the touched files (the full composer analyze exceeds Composer's process timeout on this machine). Tests were not run locally.

🤖 Generated with Claude Code