An admission policy rollout breaks only one namespace

Most workloads admit fine, yet one namespace still fails because the namespace-scoped injection path has not propagated the new trust bundle.