ArgoCD drift across 3 namespaces after a JWT hotfix: how we reconciled without breaking auth

The on-call team had been chasing a 30% 401 rate on profile-service for two hours when we got pulled in. Only profile-service, only some pods, only authenticated requests. The shape of that number is