Reusable workflow caller changes the OIDC subject and breaks deploy role trust

The same deployment worked as a repository-local workflow, but it fails after moving into a reusable workflow because the token subject no longer matches the original trust condition.