A reusable workflow widens token permissions centrally and one caller still deploys with a narrow scope

A reusable deployment workflow was fixed, but one repository still cannot assume the cloud role.