`spec.podOverrides.spec.serviceAccountName` not applied to the generated Pod

[jrderuiter]

Describe the bug

Setting spec.podOverrides.spec.serviceAccountName on a MarimoNotebook does not propagate to the created Pod. It keeps the namespace's default SA.

Steps to reproduce

kubectl create ns marimo-demo

apiVersion: v1
kind: ServiceAccount
metadata:
name: marimo-demo-sa
namespace: marimo-demo
---
apiVersion: marimo.io/v1alpha1
kind: MarimoNotebook
metadata:
name: marimo-demo
namespace: marimo-demo
spec:
storage:
    size: 1Gi
auth: {}
podOverrides:
    spec:
    serviceAccountName: marimo-demo-sa

kubectl apply -f demo.yaml
kubectl -n marimo-demo get pod marimo-demo \
-o jsonpath='{.spec.serviceAccountName}{"\n"}'

Expected

marimo-demo-sa

Actual

default

Environment

• operator version (image tag or kubectl get deployment -n marimo-operator-system): ghcr.io/marimo-team/marimo-operator:main
• kubectl-marimo version (kubectl-marimo --version): not-installed
• Kubernetes version (kubectl version --short): v1.31.5+k3s1 (server)
• Cloud / cluster type (e.g. CKS, GKE, kind): k3d
• OS: macOS

Will you submit a PR?

• Yes, I'd like to fix this