The service account token audience is restricted correctly, but the in-cluster dashboard still requests the default audience and loses API access

Identity hardening worked, yet one client was never updated to the narrowed trust contract.