Constant BINDCAR_TOKENREVIEW_CLUSTER_ROLE_BINDING_YAML 

pub const BINDCAR_TOKENREVIEW_CLUSTER_ROLE_BINDING_YAML: &str = "# Copyright (c) 2025 Erick Bourgeois, firestoned\n# SPDX-License-Identifier: MIT\n#\n# Binds the `bindcar-tokenreview` ClusterRole to the operand BIND9\n# ServiceAccount (`bind9`), which is the identity the bindcar sidecar runs as\n# and therefore the identity that performs the TokenReview API call.\n#\n# Multi-namespace note: the operand `bind9` ServiceAccount is created in every\n# namespace that runs a Bind9Instance. Add one subject per operand namespace\n# (or create an additional ClusterRoleBinding) so bindcar can validate tokens\n# from each. The default single-namespace install binds `bindy-system` only.\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n  name: bindcar-tokenreview\n  labels:\n    app.kubernetes.io/name: bindy\n    app.kubernetes.io/part-of: bindy\n    app.kubernetes.io/component: rbac\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: ClusterRole\n  name: bindcar-tokenreview\nsubjects:\n  - kind: ServiceAccount\n    name: bind9\n    namespace: bindy-system\n";

Embedded TokenReview ClusterRoleBinding (bindcar 0.7.0 Mode B).

The static manifest binds the operand bind9 ServiceAccount in bindy-system; the bootstrap path rewrites the subject namespace to the requested --namespace via build_tokenreview_cluster_role_binding.