Projected service account token audience mismatch breaks external Vault auth

The pod has a valid token, but external auth still fails because the verifier expects a different audience than the projected token request generated.