Restore CAA lookup timeout in provision worker

Keep the previous per-lookup dnsExchangeTimeout around CheckCAA
so rebased dnsclient calls do not drop main's deadline.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

pkg/certmanager/provision_worker.go

@@ -348,7 +348,10 @@ func (h *beginChallengeHandler) loadSkipDNSChecks(ctx context.Context, hostname
 }
 
 func (h *beginChallengeHandler) checkCAARecords(ctx context.Context, hostname string) error {
-	err := h.dnsClient.CheckCAA(ctx, hostname, h.caaIssuerDomain)
+	dnsCtx, cancel := context.WithTimeout(ctx, dnsExchangeTimeout)
+	defer cancel()
+
+	err := h.dnsClient.CheckCAA(dnsCtx, hostname, h.caaIssuerDomain)
 	if err == nil {
 		return nil
 	}