fix: show explicit half-done warning when build-client-full fails after revoke

Split revoke_issued and build_client_full into separate try/except blocks.
When renewal is in progress and build-client-full fails after a successful
revoke, display an explicit warning that the old certificate has been revoked
but no new one was built, and advise re-running the renewal.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

openvpncertupdate.py

@@ -799,12 +799,25 @@ class CursesApp:
         final_cn = form.cn
         self._msg(stdscr, f"Generating certificate for {final_cn}…")
 
-        try:
         if is_renewal:
+            try:
                 revoke_issued(EASYRSA_DIR, EASYRSA_PKI_DIR, final_cn, CA_PASSPHRASE)
+            except EasyRSAError as exc:
+                self._error(stdscr, f"EasyRSA error during revoke:\n{exc}")
+                return True
+
+        try:
             build_client_full(EASYRSA_DIR, EASYRSA_PKI_DIR,
                               final_cn, form.password, CA_PASSPHRASE)
         except EasyRSAError as exc:
+            if is_renewal:
+                self._error(
+                    stdscr,
+                    f"EasyRSA error during build-client-full:\n{exc}\n\n"
+                    f"WARNING: {final_cn} has been revoked but no new cert was built.\n"
+                    f"Re-run renewal for this CN to issue a new certificate.",
+                )
+            else:
                 self._error(stdscr, f"EasyRSA error:\n{exc}")
             return True