k8s exec-credential never detects an invalid cached token: /healthz is a Pomerium-internal path

Affects: main as of 0849a66 ("cli: remove fresh token validation, use healthz endpoint", #676). Last good release: v0.32.1-rc.1.

What happens

CheckBearerToken probes <route-host>/healthz to decide whether a cached exec credential is still usable. Pomerium serves /healthz itself on every route host — buildPomeriumHTTPRoutes registers /ping and /healthz as control-plane routes, and evaluateInternal allows internal paths unless they're in internalPathsNeedingLogin, which /healthz is not. The probe therefore returns 200 regardless of the bearer token, including no token at all.

Result: whenever a session dies before the JWT's exp (browser logout, revoked session, failed IdP refresh, Pomerium restart), the cached credential is served to kubectl indefinitely and every command fails until the user manually runs pomerium-cli k8s flush-credentials. The /livez probe used in v0.30.0–v0.32.1-rc.1 did not have this problem, since /livez is proxied through policy to the API server.

Reproduce

1. kubectl against a Pomerium-protected cluster using k8s exec-credential; authenticate.
2. Sign out of the Pomerium session in the browser (JWT exp still in the future).
3. kubectl get pods → auth failure, and re-running never triggers a new login.

Expected

An invalidated session makes the probe fail, the cached credential is discarded, and a login flow starts automatically.

Suggested fix

Revert the probe path to /livez, or use a path that requires a session, e.g. /.pomerium/jwt. If the intent of #676 was to avoid depending on the upstream API server exposing /livez, /.pomerium/jwt is the safer option — it's served by Pomerium and is in internalPathsNeedingLogin, so it 401s without a valid session.

Locate CheckBearerToken and inspect the probe path used for cached exec credentials, along with the internal route handling for /healthz and /.pomerium/jwt. Reproduce the browser sign-out scenario with kubectl, then verify that an invalid session causes the cached credential to be discarded and login to restart automatically.