OIDC provider issuer URL rotates and every projected token verifier in the cluster rejects new tokens

Token projection still works, but consumers fail because the issuer trust path and JWKS discovery URL changed underneath long-lived verifiers.