Thanks for looking into this one, it has been a confusing error to debug. I traced the path on main and I think the reporter's expected line can be restored without a verbosity flag.

filters/authentication.go:75 (vendored k8s.io/apiserver) logs the error returned by the union authenticator, and the union authenticator aggregates the errors of each authenticator in the chain. Upstream's webhook token authenticator returns the review error when the token is not authenticated:

// vendor/k8s.io/apiserver/plugin/pkg/authenticator/token/webhook/webhook.go:170
if !r.Status.Authenticated {
    var err error
    if len(r.Status.Error) != 0 {
        err = errors.New(r.Status.Error)
    }
    return nil, false, err
}

vcluster's delegating authenticator returns nil, false, nil on the same branch, so the aggregate only ever contains invalid bearer token. Returning errors.New(tokReview.Status.Error) there mirrors upstream and brings back [invalid bearer token, oidc: email not verified] in the existing ERROR line, which is what #3930 asks for. A V(1) log works too but needs -v on the syncer; which of the two the maintainers prefer is their call, I just wanted to put the upstream behaviour next to it.

Two small things on the PR itself: the description mentions a unit test for the rejection path, but the diff only has the one file; and gofmt -l flags the file because the blank line between the import block and var ( was removed.