bd357fc837
The scope ceiling rewrite landed here and was reverted two PRs up, leaving the stack asserting both directions. The exchange intersects requested scopes with the token's cap again, a capless token passes through like a PAT, and the route keeps only the environment claim check and the acting client.