Protected environment exists but deploy still bypasses manual approval

A dynamic environment-selection branch path resolves to a target that is not actually covered by the intended approval gate.