ci(deploy-watch): print Railway's own error instead of guessing at the token type

The first live run failed on "Could not resolve environmentId from the token",
which is the right guard but a dead end diagnostically — it reports what did not
happen and swallows what Railway actually said. The response body carries the
real message and contains no credential, so there was never a reason to hide it.

Also captures the probe with `|| true`, because `curl -sSf` under `set -e` would
abort the step on a non-2xx before the diagnostic could ever print — the failure
mode most worth seeing was the one guaranteed to stay invisible.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QwrqK15CtSW1sWAyEzopco

Author: mpstaton

.github/workflows/deploy-watch.yml

@@ -61,11 +61,19 @@ jobs:
 
           # The token knows which environment it belongs to, so no Railway IDs
           # are committed here. Swapping the secret repoints the whole workflow.
-          ENV_ID=$(api '{"query":"query { projectToken { environmentId } }"}' \
-            | jq -r '.data.projectToken.environmentId')
-
-          if [ -z "$ENV_ID" ] || [ "$ENV_ID" = "null" ]; then
+          # `|| true` so a non-2xx from curl -f still reaches the diagnostic
+          # below instead of dying silently under `set -e`.
+          PROBE=$(api '{"query":"query { projectToken { environmentId } }"}' || true)
+          ENV_ID=$(printf '%s' "$PROBE" | jq -r '.data.projectToken.environmentId // empty')
+
+          if [ -z "$ENV_ID" ]; then
+            # `projectToken` resolves ONLY for a project token. An account or
+            # team token authenticates fine and returns null here, which is the
+            # overwhelmingly likely cause. Print the response — it carries
+            # Railway's own error message and contains no credential.
             echo "::error::Could not resolve environmentId from the token. Is it a PROJECT token?"
+            echo "Railway response:"
+            printf '%s\n' "$PROBE" | jq . 2>/dev/null || printf '%s\n' "$PROBE"
             exit 1
           fi