The sweep needs the quality token, and the grant was applied to the live
policy. Recording it here keeps the definition and the cluster agreeing about
this path.
Note for whoever reconciles this properly: the live maintenance policy grants
22 paths and this list names 7. sync_k8s_auth replaces a role's policy
wholesale from read_paths, so running it today would revoke nextcloud, wger,
firefly, comms and metis access from Ariadne. Its cron is 0 0 1 1 * - once a
year - which is why the drift has survived rather than been caught. Widening
this list to match reality is worth doing deliberately, not as a side effect
of adding one path.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
63a8abb743