a8459f7ecf
metadata.name must be an RFC 1123 subdomain (no underscores); spec.name (the value actually matched against the JWT role claim) stays read_only/ product_manager to match the realm role names exactly.