Pin cross-role waiting list promotion

[mroderick]

Promotions filter by the cancelling invitation's role via WaitingList.where_role, but nothing pinned that — a change to next_spot could regress cross-role promotion silently. This PR adds the pin at both levels, against master's WaitingList.next_spot (the rename to promote_next happens in feat/post-close-rsvp-waitlist; the filtering rule carries over).

One of five small PRs from the same pre-existing-gap audit. Heads are reviewed independently; if a sibling merges first expect a trivial rebase.

Detail

Model level (spec/models/waiting_list_spec.rb): next_spot(workshop, 'Student') returns nil while only an older Coach entry is waitlisted; the entry survives untouched.

Controller level (spec/controllers/waiting_invitation_controller_spec.rb): a coach is waitlisted, a student seat frees up via reject — the coach invitation keeps attending nil and the waitlist is unchanged.

Review notes

• Both specs are green on master — these pin current, intended behaviour, no fix involved.

Sibling PRs:

• Rejecting drops a cancelling member's waiting-list entry #2997 (fix/waiting-list-self-promotion-on-reject)
• Redirect instead of a 500 when the waiting-list entry is already gone #2998 (fix/waiting-list-destroy-missing-entry)
• Skip CSRF for reject (token-authenticated, no session) #2999 (fix/reject-token-no-session)
• Assert the waiting-list promotion email on reject #3001 (test/waitlist-promotion-email)