Cloud audit agent looks healthy but stopped shipping logs after a service-account rotation

The agent process runs, yet the audit pipeline is effectively dark because the credential or permission path it uses no longer matches the rotated identity.