[jochenehret]

• A short explanation of the proposed change:

  ManagedServiceInstance and UserProvidedServiceInstance are STI subclasses
  of ServiceInstance, but only "ServiceInstance" is registered in
  encrypted_classes. The before_create hook checked only self.class.name,
  so precursor INSERTs for managed service instances never set
  encryption_key_label, leaving it NULL permanently when the failure path
  skipped the credentials= setter.

  Fix: walk the ancestor chain instead of checking the class name directly.

• An explanation of the use cases your change solves

On a productive system, there are often a few service_instance rows without an encryption_key_label, e.g. when the service instance creation failed. In this case, the check_cc_database_key errand reports that some rows need re-encryption and then you have to start the rotate_cc_database_key errand. We would like to avoid this overhead. Assigning the current encryption_key_label even if the creation fails solves the problem.

• Links to any other associated PRs
  New Rake task to check for ccdb encryption key rotation #5476
  Rotate cc db key pre check capi-release#696
  "check" db key errand: Log number of rows using encryption keys #5593

• I have reviewed the contributing guide

• I have viewed, signed, and submitted the Contributor License Agreement

• I have made this pull request to the main branch

• I have run all the unit tests using bundle exec rake

• I have run CF Acceptance Tests -> only the include_services suite, passes

This PR has been created with Claude Code.