An RBAC bridge maps admin groups correctly in staging and drops them in...

The token contains the right groups, yet one environment's mapper is reading an older claim shape and silently yields no admin roles.