A reusable workflow updates its permissions block, but the caller workflow still downgrades the token scope and deployment cannot assume the cloud role

The shared workflow looks fixed, yet the effective identity is still too narrow because the caller constrains it further.