I think I've cracked it: it does not work in Firefox Private mode.
Interestingly, the reason is (as I discovered) that most of these tools consider cross-origin requests as a signal of a third-party tracker or ad, and therefore block it. Pinafore works by talking directly to the instance's API, and so the instance itself is suspected to be a third-party tracker. ️