`dapr mtls renew-certificate --restart` silently ignores restart failures and never restarts the scheduler statefulset

[Mukuwul]

Expected Behavior

After rotating certificates with dapr mtls renew-certificate -k --restart, all control-plane services — including statefulsets/dapr-scheduler-server (part of the control plane since runtime 1.14) — are restarted, and any restart failure is reported with a non-zero exit code.

Actual Behavior

Three defects in cmd/renew_certificate.go (checked at 96dd71a):

1. The restart's error is silently discarded. restartControlPlaneService() returns an error, but the call site drops it, and the if err != nil beneath tests a stale variable that is provably nil at that point (a non-nil value would already have exited via logErrorAndExit a few lines up). A failed control-plane restart therefore still prints "Certificate rotation is successful!" and exits 0 (cmd/renew_certificate.go#L126-L141).
2. The scheduler is never restarted. The restart list covers sentry, sidecar-injector, operator and placement — but not statefulsets/dapr-scheduler-server (cmd/renew_certificate.go#L172-L178). This was reported from the field in dapr mtls renew-certificate -k --valid-until <days> --restart did not restart statefulsets/dapr-scheduler-server #1574, which was closed by the stale bot without a fix.
3. Namespace lookup failure is ignored. If kubernetes.GetDaprNamespace() fails, the failure is printed (to stdout) and execution continues, producing kubectl rollout restart -n "" (cmd/renew_certificate.go#L179-L182).

Combined effect: in exactly the scenario this flag exists for — production certificate rotation — every failure mode is swallowed and the operator walks away believing the control plane picked up the new certificates.

Steps to Reproduce the Problem

1. dapr init -k on a cluster with runtime >= 1.14 (scheduler present).
2. dapr mtls renew-certificate -k --valid-until 365 --restart
3. Observe that statefulsets/dapr-scheduler-server is never restarted, and that any kubectl failure during the restart step still yields the success message and exit code 0.

I have a fix ready and will open a PR right after filing this.

Release Note

RELEASE NOTE: FIX dapr mtls renew-certificate --restart now restarts the scheduler statefulset and fails with a non-zero exit code when any control-plane restart fails.

[Mukuwul]

Fix is up in PR #1670 — threads the restart error through to a non-zero exit, bails on namespace lookup failure, and restarts statefulsets/dapr-scheduler-server when present (probed first, so pre-1.14 clusters are unaffected).