Briefing
The breach response is on its last stage: every automation account was re-provisioned from the new access review, and the payments deploy job is the first to run since.
It can read and list its Deployment, but the rollout step fails with Forbidden when it applies the image change, and the ledger change it carries is stuck.
The job's service account and RoleBinding both exist and look correct at a glance.
With the clock running, Sam has offered to bind the account to cluster-admin just for tonight and scope it down in the morning.
The fix is yours to find: hints, the recovery checks and the debrief unlock inside the incident.