A namespace-scoped tenant admin in an ordinary hub namespace can create a namespaced `ClusterCurator`. The ClusterCurator controller responds by creating a `cluster-installer` ServiceAccount in that tenant namespace and cluster-scoped RBAC that binds `ClusterRole/curator` to that ServiceAccount through `ClusterRoleBinding/curator-crb`.

Because the same tenant namespace admin can create `serviceaccounts/token` for ServiceAccounts in its namespace, the tenant can mint a token for the controller-created `cluster-installer` ServiceAccount and directly act with cluster-wide curator authority.

This is not merely "a tenant can create a lifecycle object." The vulnerable behavior is that the controller materializes cluster-wide RBAC onto a predictable ServiceAccount in a tenant-controlled namespace, and that ServiceAccount token is tenant-mintable.