Fix: Strip ServiceAccount token volume mounts from EphemeralContainers during restore
