Your team stores a device API token in a GitLab CE project CI/CD variable named DEVICE_TOKEN, marked as both 'Masked' and 'Protected'. The deploy job runs correctly on the protected 'main' branch but fails on a feature branch merge request pipeline with an authentication error because DEVICE_TOKEN is empty. The token value itself is a valid 40-character alphanumeric string. What is the most likely cause?