tare dataplane identity

Bind the data plane's outbound-signing ServiceAccount to a cloud IAM identity
so the gateway authenticates to upstreams (e.g. AWS Bedrock) with the pod's
role instead of static credentials. Pairs with a credential-less provider
(fraser#4520, PR #4758).

Usage:
  tare dataplane identity [flags]
  tare dataplane identity [command]

Available Commands:
  bind        Bind the signing ServiceAccount to an AWS IAM role via IRSA

Global Flags:
  -q, --quiet     Suppress progress output; only errors and the final summary go to stderr
  -v, --verbose   Verbose output: plain-mode progress lines plus full per-blob chunk logs to stderr

Use "tare dataplane identity [command] --help" for more information about a command.