RBAC fails hard when `mv`/rename to a subject binary.