A reusable workflow assumes a broader OIDC scope than the caller actually grants during a failover rehearsal

The shared logic is valid, but the effective token permissions are still narrower than the deployment step needs. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.