I think what you are asking is if the EGC ran with primary circuit conductors is allowed to connect to the chassis of the xfmr and no where else, this is not the case. Since you must re-bond the separately derived system the "primary" EGC will be connected to X0, the xfmr chassis, neutral & ground bus, derived system GES via the system bonding jumper. This ties everything back together at the newly derived system, it is kind of like starting over. The secondary side is electrically isolated from the primary and a new neutral is being derived this is not making another ground/neutral connection on the load side of the service.