docs: add draft enhancement proposal for serviceAccount deprecation

Copy EP operator-framework#1860 as starting point, add reviewer feedback reference,
PR operator-framework#2544 design doc reference, and TODO checklist for revision.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: pedjak

docs/draft/project/TODO-EP.md

@@ -0,0 +1,82 @@
+# TODO: Enhancement Proposal — Deprecate spec.serviceAccount
+
+Based on [EP #1860](https://github.com/openshift/enhancements/pull/1860) (closed),
+[PR #2544 design doc](https://github.com/operator-framework/operator-controller/pull/2544),
+and [implementation PR #2770](https://github.com/operator-framework/operator-controller/pull/2770).
+
+## Source materials
+
+- [X] Copy EP #1860 content as starting point → `docs/draft/project/service-account-deprecation-ep.md`
+- [X] Save #1860 reviewer comments as reference → `docs/draft/project/ep-reviewer-feedback.md`
+- [X] Save #2544 design doc as reference → `docs/draft/project/single-tenant-design-ref.md`
+
+## Reviewer concerns to address (from EP #1860)
+
+### everettraven (API reviewer)
+
+- [ ] "Rarely helpful" not justified — use #2544's detailed explanation of SA model failures (false sense of security, SA reference escalation, usability burden)
+- [ ] Privilege escalation risk with cluster-admin — explain risk already exists (any CE writer can reference any SA in any namespace); cluster-admin makes it explicit
+- [ ] Deprecated fields should still function — clarify: field is accepted but ignored (no validation error), existing CEs continue working
+- [ ] Downgrade handling — OCP doesn't support minor version downgrades; field remains in API so no serialization issue
+- [ ] Older client compatibility — field stays in API with `omitzero`; clients reading it see empty value, not missing field
+- [ ] `x-kubernetes-deprecated` doesn't exist — we use ValidatingAdmissionPolicy with `validationActions: [Warn]` instead (kubernetes/kubernetes#131817)
+- [ ] Alternative: better client tooling — address as considered alternative, doesn't solve fundamental SA model issues
+- [ ] Automatic upgrade privilege escalation — OLM could stamp out malicious code; address in risks section
+- [ ] How do users manage controller permissions — document RBAC + VAP as the scoping mechanism
+- [ ] What are "Synthetic Permissions" — explain and justify removal
+
+### JoelSpeed (API reviewer)
+
+- [ ] Should support three paths (no SA, namespace-scoped admin, full least-privilege) — biggest tension; propose RBAC + VAP as replacement for per-SA scoping (Stream 6 / OPRUN-4634)
+- [ ] Still need EP process for this change — yes, this EP is that process
+
+### grokspawn
+
+- [ ] Deprecation metrics — note as follow-up; currently log + VAP warning; consider `clusterextension_requested_deprecated_api` gauge
+- [ ] Include preflight permissions removal — yes, those are alpha/not GA'd, removed in implementation
+- [ ] GA'd OCP APIs have never been removed — discuss field removal timeline, keeping field in API indefinitely as ignored
+
+## EP revision tasks
+
+- [ ] Clean up EP frontmatter (update authors, dates, tracking-link to OCPSTRAT-3040)
+- [ ] Rewrite Motivation section using #2544's stronger rationale
+- [ ] Update Goals to match OCPSTRAT-3040 requirements (15 items)
+- [ ] Update Proposal/API Changes to reflect actual implementation:
+  - `omitzero` instead of pointer
+  - Godoc following OpenShift convention (`Deprecated:` at end)
+  - Relaxed immutability rule (allow clearing)
+  - ValidatingAdmissionPolicy for kubectl warnings
+  - CRB renamed to `operator-controller-cluster-admin-rolebinding`
+  - Install script handles upgrade (old CRB + ClusterRole cleanup)
+- [ ] Update Proposal/Controller Logic to reflect actual implementation:
+  - Controller uses own SA for all interactions
+  - `ServiceAccountDeprecationWarning` logs when field is set
+  - All SA impersonation/token/synthetic code removed
+  - ContentManager replaced with shared TrackingCache
+- [ ] Add Design Details section:
+  - TrackingCache architecture (single global cache, event suppression)
+  - `WithWatchesRawSource` builder option gated on Helm runtime
+  - Nil guard for TrackingCache in Apply path
+- [ ] Update Test Plan to reflect actual testing:
+  - Unit tests for admission, helm applier
+  - envtest for VAP warning capture
+  - e2e: standard (49 scenarios), experimental (54 scenarios), upgrade (st2st)
+  - Deprecation warning scenario
+- [ ] Update Graduation Criteria / Deprecation Plan for OCP timeline
+- [ ] Update Upgrade / Downgrade Strategy:
+  - CRB rename handles roleRef immutability
+  - Old RBAC resources cleaned up by install script
+  - Field remains in API, no downgrade issue
+- [ ] Add Alternatives Considered:
+  - Keep SA functional during deprecation (everettraven's preference)
+  - Synthetic permissions / impersonation model (#1897)
+  - Better client tooling for SA derivation
+  - Three paths: no SA / namespace admin / full least-privilege (JoelSpeed)
+  - RBAC + VAP as replacement for per-SA scoping
+
+## Final steps
+
+- [ ] Review draft EP for completeness and consistency
+- [ ] Port to openshift/enhancements repo (fork, branch from master)
+- [ ] Open PR against openshift/enhancements
+- [ ] Link EP PR to OPRUN-4629 and OCPSTRAT-3040