OIDC exchange fails only in reusable workflows

A shared workflow refactor succeeds for linting but deployment breaks because the federated identity provider expects a different token audience than the child workflow emits.