add_header is inherited from the enclosing configuration level only when the current level defines no add_header directives of its own. Adding one header inside a location therefore silently removes all headers defined at the server or http level for that location.
The usual casualty is a set of security headers defined once at the server level that vanish for the one location that adds a cache-control header. Nothing in the configuration test reports it; the headers are simply missing from responses for that path, which a header scanner finds long after deploy.
The same inheritance-by-replacement rule applies to proxy_set_header, fastcgi_param, and several other array-valued directives, and it is documented on each of them. The fix is to repeat the full set at every level that defines any, or to move the shared set into a separate file included at each level. Note also that add_header by default applies only to responses with certain status codes; the always parameter is required to attach a header to error responses such as 500 or 404.