fix(ci): use the Actions token, not REGISTRY_TOKEN, to read the E2E commit status

Promotion's 'Verify the staging E2E gate' step called the Gitea
commit-status API with REGISTRY_TOKEN, which has container-registry scope
but no repository scope — so the API returned 403 and promotion failed.
Switch to the built-in GITHUB_TOKEN (repo read scope), matching how
pr-checks.yml already authenticates to the Gitea API. REGISTRY_TOKEN is
still used for the docker registry login, which is its correct scope.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0146VHeLAWjDVE2B5uU67jCB

.gitea/workflows/promote.yml

@@ -67,9 +67,12 @@ jobs:
           echo "Promoting $FULL_SHA (images tagged $SHORT_SHA)"
 
       - name: Verify the staging E2E gate passed for this commit
+        # Use the built-in Actions token (GITHUB_TOKEN is the documented name;
+        # it carries repository read scope), NOT REGISTRY_TOKEN — the registry
+        # token has no repo scope, so the commit-status API returns 403.
         run: |
           STATUS_JSON=$(curl -fsS \
-            -H "Authorization: token ${{ secrets.REGISTRY_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
             "https://${REGISTRY}/api/v1/repos/${{ gitea.repository }}/commits/${{ steps.resolve.outputs.full }}/status")
           echo "$STATUS_JSON" | python3 -c "
           import json, sys

nextjs-app/components/compare/CompareOfsted.tsx

@@ -239,8 +239,17 @@ export function CompareOfsted({
             `https://reports.ofsted.gov.uk/provider/21/${school.urn}`;
           return (
             <Cell key={school.urn} school={school} index={i}>
-              <a className={s.link} href={url} target="_blank" rel="noopener noreferrer">
-                {school.school_name}&apos;s Ofsted page →
+              {/* Short visible label to save space on mobile (the coloured
+                  school name already leads the row); the full name stays in
+                  aria-label so screen readers can tell the links apart. */}
+              <a
+                className={s.link}
+                href={url}
+                target="_blank"
+                rel="noopener noreferrer"
+                aria-label={`${school.school_name}'s Ofsted page`}
+              >
+                Ofsted page →
               </a>
             </Cell>
           );