6aec05deae
Job pods only need the vault-audience projected token to log in; the default automounted ServiceAccount token hands them the repospawner Role's k8s API access that no job subcommand uses.