Replace string-based error matching with sentinel error

Introduced ErrHTTPChallengeRequired as a sentinel error and updated the
renewal flow to use errors.Is() for type-safe error checking instead of
string matching.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/certmanager/acme.go

@@ -21,6 +21,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
+	"errors"
 	"fmt"
 	"net/http"
 	"time"
@@ -57,6 +58,10 @@ type (
 	}
 )
 
+// ErrHTTPChallengeRequired indicates that an HTTP-01 challenge needs to be
+// completed before the certificate can be issued or renewed.
+var ErrHTTPChallengeRequired = errors.New("HTTP challenge required")
+
 func NewACMEService(email string, keyType keys.Type, directoryURL string, insecureTLS bool, logger *log.Logger) (*ACMEService, error) {
 	accountKey, err := keys.Generate(keyType)
 	if err != nil {
@@ -229,7 +234,7 @@ func (s *ACMEService) ObtainCertificate(
 	// The challenge token and key auth will be stored and served via HTTP
 	// The caller is responsible for ensuring the HTTP endpoint is ready
 	// before calling CompleteHTTPChallenge
-	return nil, fmt.Errorf("HTTP challenge ready: token=%s", challenge.Token)
+	return nil, fmt.Errorf("%w: token=%s", ErrHTTPChallengeRequired, challenge.Token)
 }
 
 func (s *ACMEService) RenewCertificate(