When a Service Level Objective (SLO) is violated in a canary deployment, the first recommended action is to roll back traffic to the last known good version.
"If your canary deployment results in errors or latency exceeding your SLOs, adjust the traffic splitting to route all traffic to a stable revision."
- Traffic Management in Cloud Run
This mitigates user impact immediately and aligns with SRE principles of error budget management and rapid remediation.

The best option for making the third-party application work while following Google-recommended security practices is to add a rule to set the iam.disableServiceAccountKeyCreation policy to off in your project and create a key. The iam.disableServiceAccountKeyCreation policy is an organization policy that controls whether service account keys can be created in a project or organization. By default, this policy is set to on, which means that service account keys cannot be created. However, you can override this policy at a lower level, such as a project, by adding a rule to set it to off. This way, you can create a service account key for your project without affecting other projects or organizations. You should also follow the best practices for managing service account keys, such as rotating them regularly, storing them securely, and deleting them when they are no longer needed.