I think this is because the toolwatcher role isn't applied anywhere. Am unsure where it was applied earlier.
@scfc do you know where it was applied earlier?
IIRC tools-login.eqiad.wmflabs (!= tools-login.wmflabs.org).
I've added it to tools-submit for now.
Is this fixed now?
Oops, yes, fixed.