fix: scope legacy service tokens to provisioned environments (#976)