Argo CD ignoreDifferences hides drift in service account annotations and the workload loses cloud identity on sync

Git and cluster appear in sync, yet the runtime identity broke because a diff-ignore rule masked the exact annotation that binds the pod to its cloud role.