Constant OPERATOR_SERVICE_ACCOUNT 

pub const OPERATOR_SERVICE_ACCOUNT: &str = "bindy";

ServiceAccount name the bindy operator runs as.

Under bindcar 0.7.0 Mode B (TokenReview), the operator presents its own SA token to the bindcar HTTP API, and bindcar validates the token’s subject against its BIND_ALLOWED_SERVICE_ACCOUNTS allow-list. That allow-list must therefore name this (the caller’s) SA, not the operand bind9 SA.