As per this A Hands-On Guide to Vault in Kubernetes blog written by Anvesh Muppeda :

• vault.hashicorp.com/agent-inject: “true”: Enables Vault Agent injection for this pod.

• vault.hashicorp.com/agent-inject-status: “update”: Ensures the status of secret injection is updated.

The vault-agent-status annotation in HashiCorp Vault's Kubernetes tells us how the Vault Agent interacts with your application pods.When you set value to "injected", it says that the Vault Agent has successfully injected the secrets into the pod and yes,the APIs to fetch password and will only be invoked on password change not on the events like token renewal.

This status helps the application to understand that it can now safely access the secrets that have been injected.

Refer to this blog written by Dominik Engelhardt, for more information and also go through this document written by Bibin Wilson,which might be helpful.