OIDC deploy role works on push events but fails on workflow_call reuse

The repository already deploys successfully on direct pushes, but the reusable workflow path now fails because the token subject pattern no longer matches the calling context.