enrollment: finish or clean up a partial CertificateSigningRequest record #365

What would you like to be added

Two fixes to the enrollment record from #360:

• Retry or clean up a request that was approved but never received its certificate.
• Track outstanding record tasks and wait for them within the shutdown drain.

Why is this needed

The service writes each record in three calls: create, approve, complete. If the completion fails after approval, the request stays Approved with no certificate. The Kubernetes cleaner only collects that state from 1.35 on, after 24 hours. On 1.30 to 1.34 it is never collected.

The task is detached from the request, so the 25s graceful drain does not wait for it. A shutdown between calls leaves the same partial record, or one created but never approved.

Issuance is unaffected: the certificate is committed before the record starts, and the service's enrollment record is the durable trail. The cost is a misleading or leftover object on the hub.

Follow-up to #360 (comment) and #360 (comment).