Projected service account token expires and the sidecar never reloads it so calls to the cloud API fail hours later

Everything works after startup, but long-lived pods lose access because one component reads the token once and never reopens the projected file.