An RBAC bridge maps admin groups in staging and drops them in production

The groups are present, yet one environment reads the old claim shape and silently returns no admin roles.