Hello,
Your first configuration.
Trunk interface can carry several different tags so you need to classifiy ingress traffic based on the tags.
service instance 3 ethernet
encap dot1q 3
The command above is a classification for VLAN 3. Yoy may do classification for other tags as well. You are missing one command which pops a tag.
rewrite ingress tag pop 1 symmetric
Second configuration is for subinterface. On subinterface, you do need to do classification, because you have different subinterfaces for different VLAN, so classification is already done on the specific sub interface.
Hope it helps,
Masoud