GitHub Actions OIDC AccessDenied May Be a Trust-Policy Problem, Not a Permission-Policy Problem

When GitHub Actions cannot assume an AWS role, diagnose OIDC trust claims before widening the role's service permissions.