VRF leak design misses the import policy for a shared services subnet

The route exists in the source VRF, but shared services remain unreachable because the target VRF never imports the right route target or policy match.