This script fixes the bootstrap token desynchronization issue in HyperShift / ARO HCP clusters on Windows environments (including Microsoft SAW terminals).
Due to upstream bug PR #8698, when tokens rotate in the token secret, hypershift-operator skips updating the user-data secret. New VMs boot with the token from user-data and get rejected with HTTP 511 Network Authentication Required.
Syncs backwards: extracts the active bearer token already baked into user-data, updates the token secret, resets the last-token-generation-time annotation, and restarts ignition-server.