Service accounts control per application

The base case is that an application can specify what service account to run on in the same namespace, something like:
- create-volumes
- inspect-pods
- namespace-control

That could be specified in the harness section of the values.yaml, like

```yaml
harness:
deployment:
serviceaccount: inspect-pods
```
If not set the default service account will be used.

Start by locating values.yaml and the harness deployment configuration that consumes the harness.deployment settings. Check how an application’s service account is selected, then implement the documented per-application setting while preserving the default service account when it is unset. Verify the resulting deployment configuration for both cases.

Written by the indexing model from the issue text.