fix(ci): use SOP_TIER_CHECK_TOKEN for qa/security review gates — unblocks #899

RFC_324_TEAM_READ_TOKEN was never provisioned. Fallback
secrets.GITHUB_TOKEN is repo-scoped and cannot probe
/teams/{id}/members/{username} — Gitea returns 403 for
non-team-members. All open PRs fail qa-review and
security-review gates permanently.

Use the already-provisioned SOP_TIER_CHECK_TOKEN as
primary. It is used successfully by sop-tier-check.yml
which also probes team memberships via the same API
endpoint — same scope (read:repository + read:organization).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/qa-review.yml

@@ -120,7 +120,7 @@ jobs:
         # no comment.user.login so the step is a no-op skip there.
         if: github.event_name == 'issue_comment'
         env:
-          GITEA_TOKEN: ${{ secrets.RFC_324_TEAM_READ_TOKEN || secrets.GITHUB_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.SOP_TIER_CHECK_TOKEN || secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           login="${{ github.event.comment.user.login }}"
@@ -151,7 +151,7 @@ jobs:
 
       - name: Evaluate qa-review
         env:
-          GITEA_TOKEN: ${{ secrets.RFC_324_TEAM_READ_TOKEN || secrets.GITHUB_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.SOP_TIER_CHECK_TOKEN || secrets.GITHUB_TOKEN }}
           GITEA_HOST: git.moleculesai.app
           REPO: ${{ github.repository }}
           # PR number lives in different places per event:

.gitea/workflows/security-review.yml

@@ -37,7 +37,7 @@ jobs:
         # so re-running on a non-collaborator comment is harmless.
         if: github.event_name == 'issue_comment'
         env:
-          GITEA_TOKEN: ${{ secrets.RFC_324_TEAM_READ_TOKEN || secrets.GITHUB_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.SOP_TIER_CHECK_TOKEN || secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           login="${{ github.event.comment.user.login }}"
@@ -62,7 +62,7 @@ jobs:
 
       - name: Evaluate security-review
         env:
-          GITEA_TOKEN: ${{ secrets.RFC_324_TEAM_READ_TOKEN || secrets.GITHUB_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.SOP_TIER_CHECK_TOKEN || secrets.GITHUB_TOKEN }}
           GITEA_HOST: git.moleculesai.app
           REPO: ${{ github.repository }}
           PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}