An OPA policy package rename leaves the fallback allow rule active in one cluster after a partial config rollout

Most clusters enforce the new package, but one environment silently drops into the default allow behavior because its bundle path never updated.