An OPA bundle signature verifies and the sidecar still serves stale decisions

Policy changes deploy successfully and one sidecar keeps enforcing the old decisions until restart.