An IAM role trust policy is updated for the new OIDC issuer, but the condition key still references the old provider path and federated deploys fail

The identity provider appears swapped successfully, yet the claim-matching logic is still anchored to the previous issuer structure.