fix(inventory): two exemptions went stale the moment their callers landed (backend#1420)

[LukasWodka]

The caller-drift audit failed on the .github develop → staging hop (#140) — the first hop this repo has ever run — with two findings. Both are real:

repo	entry	reality
.github	public-pii-gate.yml: exempt	public-pii-gate-caller.yml exists (added in #141, today)
docs	code-quality.yml: exempt	code-quality-caller.yml exists (added today)

Both callers landed today under backend#1420 and neither inventory entry was flipped. Same two-file coupling as repos.yml vs release_train, and the third time this session the guard caught it rather than a person.

What changed

Flipped both to required — with per-caller reasons, not a bare value, because what each gate can actually do differs:

• docs code-quality is that repo's only content gate (off-train, and python:false / shell:false are measured — 0 .py, 0 .sh). So gitleaks + house-rules are the real checks. soft-fail stays at its advisory default until a first green run is observed; arming it required on main is a follow-up.
• .github public-pii-gate is presence, not teeth, and deliberately so. The reusable is unarmed org-wide (PII_DENYLIST unset, backend#1409 — now parked in the backlog by decision, since the org is likely to be restructured first). It runs green on every PR without inspecting anything. required asserts the caller exists, which is what this inventory tracks; it does not assert the gate can fail. Stating that here beats a future reader inferring teeth from the word required.

Also corrected the code_quality_caller_missing anchor. It said THREE citations and named claude-skills / docs / release-train, while FOUR entries aliased it — rfcs was added later in the same session and never listed. Now three for real (claude-skills, release-train, rfcs), plus a note to trust a grep over the prose, since a hand-maintained citation list drifts from its own aliases.

Verified

PyYAML parse OK — 20 repos
caller-drift-selftest pass=42 fail=0
scripts/caller-drift.py against live org state:
Inventory: 20 repos x 9 reusables + 2 copies. Audited 20 of 20.
No drift. Every repo read, every entry matched.

Merging this unblocks #140, which is .github's first develop → staging promotion and the last of D1's five enrolments (backend#1420).

---

Note

Low Risk
Inventory-only metadata aligned with existing callers; no workflow or gate behavior changes in this diff.

Overview
Updates repo-inventory.yml so caller-drift audit matches repos where workflows were added today but inventory still said exempt.

.github — public-pii-gate.yml is now required (caller landed in #141). Comments spell out presence, not teeth: org-wide PII_DENYLIST is unset (#1409, parked), so the gate always greens; required only means the caller exists.

docs — code-quality.yml is now required after code-quality-caller.yml landed; notes that off-train docs relies on gitleaks + house-rules with python:false / shell:false, and that making the check required on main is follow-up after a green run.

code_quality_caller_missing anchor — Prose now lists three remaining aliases (claude-skills, release-train, rfcs), includes docs remediation, and warns that hand-maintained citation lists drift from YAML aliases—prefer grep over the sentence.

^{Reviewed by Cursor Bugbot for commit 76bc97a. Bugbot is set up for automated code reviews on this repo. Configure here.}