CI HUGGING_FACE_TOKEN failing with 401 on private dataset downloads

The Test job cannot download hf://policyengine/policyengine-uk-data-private/enhanced_frs_2023_24.h5@1.40.3: every dataset-backed test errors or fails with Response [401 Unauthorized] from the Hugging Face Hub. Reproduced twice on #1815 (run 31014648216, original + rerun). No assertion failures — purely auth.

Evidence it is the CI secret rather than the dataset or HF generally:

• The same pinned dataset downloads fine locally with a personal token (2026-08-05).
• Main's last push CI was green on 27 July 2026, so the breakage started within the last week.
• Today's Dependabot runs on main also show failures, consistent with missing/invalid auth.

Needs someone with org admin to check/rotate the HUGGING_FACE_TOKEN Actions secret (or the HF account's access to the private data repo). Until then every dataset-backed PR will show a red Test job.

🤖 Generated with Claude Code

Start with the failed Test job and its logs for run 31014648216, confirming the 401 occurs while downloading the pinned private Hugging Face dataset. An organization administrator should inspect or rotate the HUGGING_FACE_TOKEN secret and verify access to the private data repository. Done means dataset-backed tests pass in CI, including on a rerun.