ci: run the public PII gate on .github's own PRs (backend#1420)

[LukasWodka]

Summary

.github hosts the public-pii-gate.yml reusable but ran no PII gate on its own PRs — the only public repo with that gap (RFC-BACKEND-1405 D1 enrolment, backend#1420). This adds the missing self-caller so .github's own PRs are scanned for denylisted customer/partner names and known secrets like every other public repo.

Type

• CI / enrolment completeness

Notes

• Self-reference pinned @main, matching the existing fr-gate-caller.yml self-caller and open-question-3's answered decision (branch promotion, one standard process).
• Requires the org secret PII_DENYLIST (already set) via secrets: inherit.
• Not made a required check by this PR — a context must be observed green before it's required (the mistake that bricked tracebloc-py-package/master). Arm it as required after its first green run.

Parent: backend#1420 · RFC: backend#1405 (D1)

🤖 Generated with Claude Code

---

Note

Low Risk
CI-only enrolment wiring with no application or runtime behavior changes; inherits an existing org secret already used elsewhere.

Overview
Adds public-pii-gate-caller.yml so this repo runs the same public PII gate on its own pull requests (title, body, and commits) that other public repos already use.

The job reusestracebloc/.github/.github/workflows/public-pii-gate.yml@main with secrets: inherit (e.g. PII_DENYLIST), matching the established self-caller pattern for workflows hosted here. Triggers on the usual PR lifecycle events (opened, edited, reopened, synchronize, label changes).

^{Reviewed by Cursor Bugbot for commit 2742dcd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2742dcd. Configure here.}