fix(ci): install dependencies by cloning, not through GitHub's API

The dist path is rate-limited for anonymous callers, and a partial failure left
a half-installed vendor/ behind — the suite then failed with 500s that had
nothing to do with the code. Source clones need no quota. A GitHub token would
let us go back to the faster path.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/tests.yml

@@ -27,12 +27,12 @@ jobs:
           coverage: none
 
       - name: Install PHP dependencies
-        # Dist downloads come from GitHub, which rate-limits anonymous callers —
-        # on a shared IP that is a coin flip. Falling back to source clones keeps
-        # CI self-sufficient instead of depending on someone else's quota.
-        run: |
-          composer install --no-interaction --prefer-dist --no-progress \
-            || composer install --no-interaction --prefer-source --no-progress
+        # Source clones, not dist archives: dist downloads go through GitHub's
+        # API, which throttles anonymous callers and left a half-installed
+        # vendor/ behind — the tests then failed with 500s that had nothing to
+        # do with the code. Cloning is slower and does not need anyone's quota.
+        # Swap back to --prefer-dist once a GitHub token is configured.
+        run: composer install --no-interaction --prefer-source --no-progress
 
       - name: Prepare environment
         run: |