Requesting a narrower scope explicitly (scopes=[...]) during refresh
was rejected by Google as invalid_scope in the Airflow container's
google-auth version, even though it worked locally with a newer one.
Drop scopes= entirely — the refresh_token already carries the full
granted scope (calendar + gmail.send), no need to request a subset.