test: fail_on_warn non-fail case reflects expiring-soon status

Review feedback on PR #11: the prior "does not fail" test used a plain
valid cert, so the summary showed "Valid" rather than the nearing-expiry
status the scenario is meant to demonstrate.

Use an expiring cert that shares a subject with a newer valid replacement.
With fail_on_warn=true this must not fail (WARN_COUNT stays 0), and the
summary now correctly shows "Expiring Soon (newer replacement exists)".

Adds the multi_expiring.pem fixture for this case.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: oto-macenauer-absa

.github/workflows/test.yml

@@ -120,6 +120,12 @@ jobs:
             -out "$FIXTURES_DIR/multi_valid.pem" -days 365 -nodes \
             -subj "/CN=multi.example.com" 2>/dev/null
 
+          # Expiring-soon cert sharing a subject with multi_valid.pem, used to
+          # prove fail_on_warn does not fail when a newer valid replacement exists.
+          openssl req -x509 -newkey rsa:2048 -keyout /dev/null \
+            -out "$FIXTURES_DIR/multi_expiring.pem" -days 10 -nodes \
+            -subj "/CN=multi.example.com" 2>/dev/null
+
           echo "Fixtures generated:"
           ls -la "$FIXTURES_DIR"/*.pem
 
@@ -221,16 +227,18 @@ jobs:
           grep -q "Expiring Soon" "$SUMMARY"
           rm -f "$SUMMARY"
 
-      - name: 'Test: fail_on_warn does not fail valid certificate'
+      - name: 'Test: fail_on_warn does not fail when expiring cert has valid replacement'
         shell: bash
         run: |
           SUMMARY=$(mktemp)
-          INPUT_CERTIFICATES='["tests/fixtures/valid.pem"]' \
+          INPUT_CERTIFICATES='["tests/fixtures/multi_expiring.pem", "tests/fixtures/multi_valid.pem"]' \
           INPUT_WARNING_DAYS=30 \
           INPUT_FAIL_ON_WARN=true \
           GITHUB_STEP_SUMMARY="$SUMMARY" \
             bash validate.sh
-          grep -q "✅ Valid" "$SUMMARY"
+          # Must NOT fail (newer valid replacement exists, so WARN_COUNT stays 0),
+          # and the summary status must reflect the nearing-expiry cert.
+          grep -q "Expiring Soon (newer replacement exists)" "$SUMMARY"
           rm -f "$SUMMARY"
 
       - name: 'Test: invalid JSON input'