Removes Wild Cloud cruft.

internal/certbot/manager.go

@@ -85,6 +85,13 @@ func (m *Manager) Provision(domain, email string) error {
 	if err != nil {
 		return fmt.Errorf("certbot: %w\n%s", err, string(out))
 	}
+
+	// Verify the deploy hook created a valid PEM file
+	info, statErr := os.Stat(haproxyPEM)
+	if statErr != nil || info.Size() == 0 {
+		return fmt.Errorf("cert provisioned but HAProxy PEM is empty or missing: %s", haproxyPEM)
+	}
+
 	return nil
 }
 
@@ -166,6 +173,9 @@ func (m *Manager) BuildHAProxyCert(domain string) error {
 		return fmt.Errorf("read privkey: %w", err)
 	}
 	combined := append(certData, keyData...)
+	if len(combined) == 0 {
+		return fmt.Errorf("combined cert+key is empty for %s", domain)
+	}
 	outPath := HAProxyCertPath(domain)
 	if err := os.MkdirAll(filepath.Dir(outPath), 0700); err != nil {
 		return fmt.Errorf("create haproxy certs dir: %w", err)