On timeout the manager goroutine still finishes WaitForCacheSync and
closes the synced channel, but nobody reads it: on an unbuffered channel
that close blocks forever. A buffer of one lets the goroutine finish.
The TLS retry was gated on hasCerts (cert-file and key-file both set),
so a TLS-only MetaServer with a CA-signed server certificate was never
tried when the caller passed only --ca-file. The tool then reported
AuthRequiredError and recommended the cert flags that would not help.
Run the TLS retry whenever a CA file or client certificates are
provided, and report a distinct reason when the handshake fails with a
CA-only setup.
