CI ServiceAccount for the terraform-rancher pipeline; the pod's k8s token is what Vault binds to the woodpecker_terraform_rancher auth role (terraform-vault PR) for provider auth + Consul state.