Constant BINDCAR_TOKENREVIEW_CLUSTER_ROLE_YAML 

pub const BINDCAR_TOKENREVIEW_CLUSTER_ROLE_YAML: &str = "# Copyright (c) 2025 Erick Bourgeois, firestoned\n# SPDX-License-Identifier: MIT\n#\n# bindcar 0.7.0 Mode B (TokenReview): the bindcar sidecar (which runs in the\n# operand BIND9 pod as the `bind9` ServiceAccount) validates the operator\'s\n# bearer token by creating a TokenReview against the API server. This\n# purpose-built, least-privilege ClusterRole grants ONLY `create tokenreviews`\n# \u{2014} it deliberately does not grant `subjectaccessreviews` or any other verb.\n#\n# Not required for shared-secret (Mode A) deployments. Safe to apply alongside\n# the operator RBAC.\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n  name: bindcar-tokenreview\n  labels:\n    app.kubernetes.io/name: bindy\n    app.kubernetes.io/part-of: bindy\n    app.kubernetes.io/component: rbac\nrules:\n  - apiGroups: [\"authentication.k8s.io\"]\n    resources: [\"tokenreviews\"]\n    verbs: [\"create\"]\n";

Embedded TokenReview ClusterRole (bindcar 0.7.0 Mode B).

Grants create tokenreviews so the bindcar sidecar (running as the operand bind9 ServiceAccount) can validate the operator’s bearer token against the API server. Mirrors deploy/operator/rbac/tokenreview-clusterrole.yaml.