chore(ci): retire the public PII gate everywhere

[LukasWodka]

Summary

Removes the public PII gate in full, per Lukas (2026-08-10) — "remove the PII-gate from everyone, everything for now."

The gate was already inert: parked under backend#1409 (the PII_DENYLIST org secret was never provisioned, so it failed closed on every public-repo PR while being a required check nowhere), and its public callers were removed org-wide. This deletes what remained and cleans up the trail.

What is removed

• .github/workflows/public-pii-gate.yml — the reusable gate
• .github/workflows/public-pii-gate-selftest.yml — its decision-table selftest
• scripts/tests/pii-gate-selftest.sh — the selftest harness

References fixed (would otherwise dangle at deleted files)

• code-quality-caller.yml, code-quality.yml — dropped pointers to the removed gate + selftest
• version-bump-gate.yml — kept the override-ordering + grep-error lessons, past-tensed to "the retired public-pii-gate"
• caller-drift.py — the visibility-mismatch finding no longer claims the pii gate is required

Kept intentionally (history, not live files)

• repo-inventory.yml retirement tombstone
• conformance-gate.yml defect-class lesson (SIGPIPE rc=141)

Both reference backend#1409, not a live workflow.

Test plan

• No active caller invokes the reusable → nothing loses a required check
• Selftest is deleted in the same PR that deletes the files it guarded → no orphaned trigger
• caller-drift.py no longer expects a pii caller (already absent from the inventory), so no repo will be re-flagged

Closes the "remove PII gate" request. Related now-moot tickets (backend#1630, .github#62/#165, backend#1559) tracked separately.

---

Note

Low Risk
Removes unused CI workflows and tests with no runtime or auth changes; remaining repos should not lose required checks if callers were already removed.

Overview
Fully removes the org’s public PII gate: the reusable workflow public-pii-gate.yml, its CI selftest workflow, and scripts/tests/pii-gate-selftest.sh.

Updates comments and docs so nothing still points at deleted workflows—code-quality-caller.yml / code-quality.yml drop PII-gate mentions; version-bump-gate.yml keeps override-ordering lessons but refers to the retired gate; caller-drift.py says repo visibility drives which caller set applies, not PII-gate requirements.

No replacement scanning is added here; callers were already gone and the gate was inert without PII_DENYLIST.

^{Reviewed by Cursor Bugbot for commit 2c90f05. Bugbot is set up for automated code reviews on this repo. Configure here.}