Required permissions for /accounts/<account_id>/email/routing/rules/plan (blocks email addresses deploy)

### Question

What minimum API-token permissions authorize `/accounts//email/routing/rules/plan`?

I'm hitting `Authentication error [code: 10000]` on this call during `wrangler deploy`, with a build token that already grants all permissions the token UI exposes for Email Routing. Trying to figure out what's missing.

### Context

`wrangler.jsonc` uses the top-level `addresses` field (Email Routing → "Send to a Worker"):
```jsonc
{
"name": "",
"addresses": ["app1@example.com", "app2@example.com"]
}
```

From the cloudflare/workers-sdk#14471 implementation, the `addresses` deploy step reads a **plan** and then applies via **per-zone rule endpoints**. The plan read is what fails for me:

```
✘ [ERROR] A request to the Cloudflare API
(/accounts//email/routing/rules/plan) failed.
Authentication error [code: 10000]
```

### What works vs what doesn't

- ✅ `wrangler deploy` locally (with super-admin account)
- ❌ `wrangler deploy` from **Workers Builds CI**

### Permissions of the API Token used in build

```
(account scope) —
Email Routing Addresses: Edit, Email Sending: Edit, ...
All zones (zone scope) —
Email Routing Rules: Edit, ...
```

### Environment
- `wrangler` 4.115.0, Workers Builds CI (non-interactive), `bun@1.3.11` / `nodejs@24.18.0`.

cloudflare/workers-sdk#14471 で参照されている addresses deploy の実装と、失敗している /accounts//email/routing/rules/plan リクエストから始めます。Issue に示されている account トークンと zone トークンの権限を比較し、続いてローカルの super-admin によるデプロイと Workers Builds CI の違いを再現します。plan エンドポイントを認可する最小権限を特定できれば完了です。

索引モデルが issue の本文から書いたものです。