The token is stored as an instance-level Actions Variable
(Site Administration > Actions > Variables), not a Secret. secrets.WATCHTOWER_TOKEN
always resolved to empty, so the watchtower trigger request carried
no Authorization value and was rejected (401 Invalid token attempt).