Patch a NoExecute toleration onto an already-running Pod.

Tolerations are one of the few pod spec fields addable after creation

An incident responder later taints the suspect node NoExecute to evict everything running on it

The taint manager evicts every Pod without a matching toleration.

The pre-patched Pod is skipped and keeps running

A backdoor Pod outlives the exact response action meant to remove it from the node