docs(standards): the PII gate no longer exists, so stop promising it (backend#1630)

[LukasWodka]

Caught by Bugbot on the model-zoo staging mirror (model-zoo#131, correctly held): the same promotion that deletes public-pii-gate-caller.yml also carries a CLAUDE.md asserting "gitleaks and the PII gate will catch it". The gate was retired earlier today (backend#1409, Lukas's decision); this line was not updated with it.

That breaks this file's own rule, which I wrote:"If your change makes a statement in any CLAUDE.md, BUGBOT.md, or runbook false, update that file in the same PR." I retired the gate and left the canon promising it — and this canon syncs into every repo's CLAUDE.md, so the false claim was queued to propagate to 19 repos.

The new text names the gap rather than hiding it

- … gitleaks catches secrets in **code**. Nothing scans PR titles, descriptions or
commit messages: the public PII gate that did was retired on 2026-08-06
(backend#1409), so keeping customer names out of PR prose on public repos is on
you, not on a check.

Deleting the reference alone would have been worse than the false claim in one specific way: a reader who saw only "gitleaks catches it" would reasonably assume PR prose was covered too. gitleaks reads code. The retired gate read titles, descriptions and commit messages — which is exactly where a customer name is easiest to leak on a public repo, and now the only control there is review.

Sequencing note for #1602

If any of the ~19 docs/1602-org-standards-sync PRs have already been opened with the old block, they carry the false sentence and need a re-sync after this merges. The sync workflow's create-prs dispatch regenerates from the canon, so re-running it is the fix — not hand-editing 19 PRs.

Unblocks model-zoo#131's held thread: the removal was intentional, and this is the "fix the CLAUDE.md claim" half of the two options that ticket offered.

Parent backend#1405.

---

Note

Low Risk
Documentation-only change to org standards prose; no runtime, auth, or CI behavior is modified in this diff.

Overview
Fixes stale quality-bar text in the org-wide org-standards.md canon that still said gitleaks and the PII gate will catch customer data in commits and PR metadata after the public PII gate was retired (backend#1409).

The bullet now states that gitleaks only scans code, that nothing automated scans PR titles, descriptions, or commit messages anymore, cites the retirement date and ticket, and puts keeping customer names out of public PR prose on reviewers instead of implying a check still exists.

Because this file syncs into every repo’s CLAUDE.md, the change stops the false claim from propagating on the next org-standards sync.

^{Reviewed by Cursor Bugbot for commit 4c8a410. Bugbot is set up for automated code reviews on this repo. Configure here.}