Fix: the Azure Key Vault SDK path (option 7) was acquiring a plain BEARER token, because public Azure.Identity 1.21.0 has no PoP/mTLS API (confirmed by reflection). It now uses the binding-enabled preview packages from the azure-sdk public dev feed:
Azure.Core 1.60.0-alpha.20260622.10 (bound-token pipeline)
Azure.Identity.Broker 1.8.0-beta.1 (pulls the preview Azure.Identity)
Azure.Security.KeyVault.Secrets 4.12.0-beta.1
The binding-enabled ManagedIdentity* types ship in the Azure.Identity namespace inside Azure.Core and clash with the Azure.Identity that Microsoft.Identity.Web pulls in, so the project binds to them via an extern alias (azcore). Verified: option 7 now routes through ImdsV2 GetCsrMetadataAsync (the bound flow), not the v1 bearer endpoint. A NuGet.config wires the dev feed.