Zitadel omits urn:zitadel:iam:org:id from the id_token for the default scopes.
Requesting urn:zitadel:iam:user:resourceowner yields the user's org id, which
deriveTenantId already understands. Also log claim keys (never values) when the
tenant is still absent.