A ServiceAccount token audience is correct for the main API call while an admission sidecar now forwards the same token to a different verifier during a staged decommission

The pod identity works in one place and fails when reused in a path with a stricter audience check. The service still works through the primary path, but one dependency only fails when the old component is finally drained away.