Correct Answer:

See the Explanation below for complete solution.
Explanation:
Before you start
Log in to SAP BTP Cockpit.
Open your correct Global Account.
Go to the Shared Services directory.
Open the SH Dev subaccount.
This matters because all three required actions must be done inside SH Dev, not in the directory and not in another subaccount.
Part 1 - Entitle the service in SH Dev
Step 1 - Open the subaccount
In the cockpit, choose Directories.
Open Shared Services.
Select SH Dev.
You should now be on the SH Dev subaccount page.

Step 2 - Open Entitlements
In SH Dev, choose Entitlements.
SAP documents that service plans and quotas for a subaccount are added in the subaccount's Entitlements are a.
Step 3 - Add the required service plan
Click Configure Entitlements or Add Service Plans.
Search for SAP Build Work Zone, advanced edition.
Select the service.
Choose the plan standard (Application).
Set the quantity to 1 if a quota/amount field is shown.
Save the entitlement changes.

This task explicitly asks for one standard (Application) service plan. SAP Help also notes that SAP Build Work Zone usage depends on the correct entitlement being available in the subaccount first.
Verify
Under Entitlements, you should now see:
SAP Build Work Zone, advanced edition
plan: standard (Application)
quantity: 1 if shown
Part 2 - Establish trust to the identity provider
Step 4 - Open Trust Configuration
In SH Dev, go to Security.
Choose Trust Configuration.
SAP Help states that trust to a custom identity provider is established from Security > Trust Configuration in the SAP BTP cockpit.
Step 5 - Create the trust
Click Establish Trust.
Enter or select the identity provider:
agvlamkzw.accounts.ondemand.com
Continue through the wizard.
Save the trust configuration.
SAP documents that to use a custom identity provider, the subaccount must have a trust relationship to that provider. SAP also highlights that apps such as SAP Build Work Zone rely on SAP Cloud Identity Services trust configuration.

Verify
On the Trust Configuration page, you should see:
agvlamkzw.accounts.ondemand.com
as a trusted identity provider.

Part 3 - Create the subscription
Step 6 - Open Instances and Subscriptions
In SH Dev, go to Services.
Choose Instances and Subscriptions.
Step 7 - Create the subscription
Click Create.
Choose Subscription if the cockpit asks for a type.
Search for SAP Build Work Zone, advanced edition.
Select the service.
Choose the plan standard.
Confirm the creation.
SAP Help for SAP Build Work Zone scenarios indicates that the subaccount needs the correct entitlements and subscription flow to expose and use SAP Build Work Zone content.
Step 8 - Confirm subscription status
Stay on Instances and Subscriptions.
Check that the new subscription appears and is active.
Verify
You should see:
SAP Build Work Zone, advanced edition
plan: standard
subscription created successfully

Final expected result
Inside SH Dev:
the entitlement for SAP Build Work Zone, advanced edition exists
the entitled plan is standard (Application)
trust is established to agvlamkzw.accounts.ondemand.com
a subscription exists for SAP Build Work Zone, advanced edition
the subscription uses the standard plan
Common mistakes to avoid
Doing the entitlement in Shared Services directory instead of SH Dev
Choosing SAP Build Work Zone, standard edition instead of advanced edition Choosing the wrong plan; the entitlement must be standard (Application) Forgetting the trust step to agvlamkzw.accounts.ondemand.com Trying to subscribe before the entitlement exists