Required permissions for /accounts/<account_id>/email/routing/rules/plan (blocks email addresses deploy)

### Question

What minimum API-token permissions authorize `/accounts//email/routing/rules/plan`?

I'm hitting `Authentication error [code: 10000]` on this call during `wrangler deploy`, with a build token that already grants all permissions the token UI exposes for Email Routing. Trying to figure out what's missing.

### Context

`wrangler.jsonc` uses the top-level `addresses` field (Email Routing → "Send to a Worker"):
```jsonc
{
"name": "",
"addresses": ["app1@example.com", "app2@example.com"]
}
```

From the cloudflare/workers-sdk#14471 implementation, the `addresses` deploy step reads a **plan** and then applies via **per-zone rule endpoints**. The plan read is what fails for me:

```
✘ [ERROR] A request to the Cloudflare API
(/accounts//email/routing/rules/plan) failed.
Authentication error [code: 10000]
```

### What works vs what doesn't

- ✅ `wrangler deploy` locally (with super-admin account)
- ❌ `wrangler deploy` from **Workers Builds CI**

### Permissions of the API Token used in build

```
(account scope) —
Email Routing Addresses: Edit, Email Sending: Edit, ...
All zones (zone scope) —
Email Routing Rules: Edit, ...
```

### Environment
- `wrangler` 4.115.0, Workers Builds CI (non-interactive), `bun@1.3.11` / `nodejs@24.18.0`.

Beginne mit der in cloudflare/workers-sdk#14471 referenzierten Implementierung von addresses deploy und der fehlschlagenden Anfrage an /accounts//email/routing/rules/plan. Vergleiche die im Issue gezeigten Berechtigungen der Account- und Zone-Token und reproduziere anschließend den Unterschied zwischen der lokalen Bereitstellung als Super-Admin und Workers Builds CI. Erledigt ist die Aufgabe, wenn du die minimale Berechtigung identifiziert hast, die den plan-Endpunkt autorisiert.

Vom Indexierungsmodell aus dem Issue-Text verfasst.