An AWS OIDC trust refresh fixes most clusters and one controller still fails

A cluster identity maintenance task succeeds broadly and later one controller in one environment alone continues failing IRSA or web-identity auth.