The Tetragon CRD defaults followChildren to false in matchBinaries, causing ArgoCD ServerSideDiff to detect a permanent diff. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>