A pod security standard allows one base image while a debug ephemeral container now violates the restricted contract during incident response during a staged decommission

Steady-state workloads comply, but the emergency troubleshooting path does not. The service still works through the primary path, but one dependency only fails when the old component is finally drained away.