{{- /*
ServiceAccount for sandbox-controller (Wave 1).

Sister of organization-controller's ServiceAccount
(products/catalyst/chart/templates/controllers/organization-controller-serviceaccount.yaml).
Default off — operator flips `.Values.enabled=true` per-Sovereign once
Wave 2's pty-server + token issuance flow is ready.
*/ -}}
{{- if .Values.enabled }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "sandbox.fullname" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "sandbox.labels" . | nindent 4 }}
{{- end }}
