Function start 

pub async fn start(
    cfg: &AcmeConfig,
    tls: &TlsConfig,
    resources: &Arc<PluginResources>,
    metrics: &GatewayMetrics,
) -> Result<Arc<AcmeRuntime>, AcmeError>

Builds storage, seeds ManagedCerts from storage (or placeholders), and spawns the renewal manager. The CA is not contacted here — the manager connects lazily — so a CA outage never blocks the listener from starting.