validation: add absolute path and overlap checks for SA token mount paths

Match the validation behavior of validateCredentials: reject relative
paths and detect parent/child mount path overlaps that would shadow
each other at runtime.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: patjlm

pkg/validation/test.go

@@ -962,9 +962,22 @@ func (v *Validator) validateServiceAccountTokens(fieldRoot string, tokens []api.
 		}
 		if token.MountPath == "" {
 			ret = append(ret, fmt.Errorf("%s.mount_path: must not be empty", fieldPath))
+		} else if !filepath.IsAbs(token.MountPath) {
+			ret = append(ret, fmt.Errorf("%s.mount_path: must be an absolute path", fieldPath))
 		} else if mountPaths.Has(token.MountPath) {
 			ret = append(ret, fmt.Errorf("%s.mount_path: duplicate mount path %q", fieldPath, token.MountPath))
 		} else {
+			for j, other := range tokens[:i] {
+				if other.MountPath == "" {
+					continue
+				}
+				if relPath, err := filepath.Rel(other.MountPath, token.MountPath); err == nil && !strings.Contains(relPath, "..") {
+					ret = append(ret, fmt.Errorf("%s.mount_path: %s is under service_account_tokens[%d] mount path %s", fieldPath, token.MountPath, j, other.MountPath))
+				}
+				if relPath, err := filepath.Rel(token.MountPath, other.MountPath); err == nil && !strings.Contains(relPath, "..") {
+					ret = append(ret, fmt.Errorf("%s.mount_path: service_account_tokens[%d] mount path %s is under %s", fieldPath, j, other.MountPath, token.MountPath))
+				}
+			}
 			mountPaths.Insert(token.MountPath)
 		}
 		if token.ExpirationSeconds != nil && *token.ExpirationSeconds < 600 {
@@ -977,6 +990,11 @@ func (v *Validator) validateServiceAccountTokens(fieldRoot string, tokens []api.
 // verifyAudienceOwnership checks if metadata's org and repo match those in the
 // audience config, verifying if it's one of the owners of the audience.
 func verifyAudienceOwnership(audience api.AllowedAudienceDetails, m *api.Metadata) error {
+	// When metadata is nil (e.g., standalone registry reference validation via
+	// IsValidReference), we can't determine org/repo ownership, so we permit the
+	// audience. This is intentionally more permissive than verifyClusterProfileOwnership
+	// because audience restrictions are enforced at the resolved config level where
+	// metadata is always available.
 	if m == nil || m.Org == "" {
 		return nil
 	}