Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="pkg/auth/tokens/internal_role.go" line_range="23-27" />
<code_context>
 	ClusterScopes []*ClusterScope   `json:"cluster_scopes"`
 }

 func (r *InternalRole) GetRoleName() string {
-	return internalRoleName
+	if r == nil {
+		return ""
+	}
+	return r.RoleName
 }

</code_context>
<issue_to_address>
**issue (bug_risk):** Consider defaulting to a non-empty role name for older tokens where RoleName may be unset

Previously this always returned `internalRoleName`, but now older tokens (which won’t have `RoleName` set) will deserialize with `RoleName == ""`, causing identities from those tokens to get an empty role name. That’s a behavior change that may break code or logging expecting the legacy name. Consider mapping an empty `RoleName` to the legacy default (e.g., `internalRoleName`), while still respecting non-empty values on newer tokens.
</issue_to_address>

### Comment 2
<location path="central/auth/internaltokens/service/service_impl_test.go" line_range="164" />
<code_context>
 		svc := createService(mockIssuer, mockClusterStore, mockRoleStore)
 		setClusterStoreExpectations(input, mockClusterStore)
-		setNormalRoleStoreExpectations(deploymentPS, singleNSScope, expectedRole, nil, mockRoleStore)
 		expectedClaims := tokens.RoxClaims{
-			RoleNames: []string{expectedRole.GetName()},
+			RoleNames: []string{internalRoleName},
</code_context>
<issue_to_address>
**suggestion (testing):** Extend GenerateTokenForPermissionsAndScope tests to cover additional InternalRole shapes

The new assertions cover the main case well. To strengthen coverage, please also add:
- A request with no permissions and/or no cluster scopes, confirming the token’s `InternalRole` has empty `Permissions` / `ClusterScopes` and is still accepted by the issuer.
- A request with multiple permissions and mixed full-cluster and namespace-limited scopes across multiple clusters, confirming all are correctly represented in `InternalRole.ClusterScopes` and `Permissions`.

These would replace some of the removed role/access-scope tests and validate behavior for more complex inputs.
</issue_to_address>