Your Agent's LLM Key Survives Every Kubernetes Secret Control

RBAC, restricted Pod Security, and automountServiceAccountToken all on, and one file read still hands over an agent's LLM API key. Tested on a...