Fix test: check peer key instead of cluster.pem for join rejection

The cluster.pem file is created during master startup in MasterKeys._setup_keys(),
regardless of whether the autoscale join succeeds or fails.

When join is rejected (e.g., missing cluster_pub_signature), the discover-reply
handler returns early before writing the bootstrap master's peer key to the
peers directory.

Updated test to check for the absence of the bootstrap master's peer key file
(<cluster_pki_dir>/peers/<bootstrap-id>.pub) as the correct indicator that
join was rejected.

Author: dwoz

tests/pytests/integration/cluster/test_autoscale_security.py

@@ -525,12 +525,12 @@ def test_autoscale_rejects_join_without_cluster_pub_signature(
     with factory.started(start_timeout=30):
         time.sleep(10)
 
-        # Check that cluster keys were NOT created (join failed)
+        # Check that the bootstrap master's peer key was NOT written (join was rejected)
         cluster_pki_dir = pathlib.Path(factory.config["cluster_pki_dir"])
-        cluster_key = cluster_pki_dir / "cluster.pem"
+        bootstrap_peer_key = cluster_pki_dir / "peers" / f"{autoscale_bootstrap_master.config['id']}.pub"
 
-        assert not cluster_key.exists(), (
-            "Cluster key should NOT be created when join is rejected"
+        assert not bootstrap_peer_key.exists(), (
+            f"Bootstrap master peer key should NOT be created when join is rejected: {bootstrap_peer_key}"
         )