After an upgrade, the kubelet image credential provider binary path changes, and pulls from the private registry fail on the new nodes only

Legacy nodes keep working, but fresh workers cannot execute the helper that mints registry credentials.