A ServiceAccount token audience is correct for the main API call

The pod identity works in one place and fails when reused in a path with a stricter audience check. The explicit configuration seems correct, yet an inherited policy no longer resolves the same way under the cleaned hierarchy. Effective ownership looks correct at first glance, but one delegated path still reflects the old hierarchy. Nominal permissions look aligned, yet one delegated control path still reflects the retired operating model. Nominal access still looks aligned, yet one delegated path continues to reflect the previous layered administration model. Nominal access looks aligned, yet one delegated or inherited path still reflects the previous, more layered model.