handlerFor silently fell back to the class name when the store was
unreadable, so CheckCRI could report a wrong verdict (false pass, or a
missing-handler failure) with no indication that the store read failed.
The store error is now returned and the CRI check warns about it.
On timeout the manager goroutine still finishes WaitForCacheSync and
closes the synced channel, but nobody reads it: on an unbuffered channel
that close blocks forever. A buffer of one lets the goroutine finish.
The TLS retry was gated on hasCerts (cert-file and key-file both set),
so a TLS-only MetaServer with a CA-signed server certificate was never
tried when the caller passed only --ca-file. The tool then reported
AuthRequiredError and recommended the cert flags that would not help.
Run the TLS retry whenever a CA file or client certificates are
provided, and report a distinct reason when the handshake fails with a
CA-only setup.
