fix(2396): release-train's customer-priority-bump exemption outlived its caller

[LukasWodka]

The conformance audit went red and blocked the .github prod promotion (#318):

1 drift finding(s):
- release-train: customer-priority-bump.yml is marked `exempt` but a caller exists
(customer-priority-bump.yml). The exemption is stale — promote it to `required`
or delete the caller.
The audit exited 1 (0 clean, 1 drift, 2 could not evaluate).

That cascades: audit fails → the conformance gate fails ("a contract change must
not merge on a failed or skipped audit") → and gate is a required context on
.github/main, so the merge API refuses the promotion outright.

The audit is right and this file was wrong

backend#2396 wired the caller in release-train this morning
(c0c6cf7, "ci(2396): wire the customer-priority-bump caller, so a bug lands in
Ready"). repo-inventory.yml still claimed the repo had none.

Flipped release-train's entry to required.

The anchor stays — and that is the part worth reading

customer_priority_bump_caller_missing is cited by three repos. Only
release-train has a caller now, so the other two citations are still accurate and
the anchor is not dead prose. Deleting it would break them.

This is the exact inverse of the kanban_closure_router_caller_missing case
documented a few lines below in the same file, where the anchor is cited once and
a flip does orphan it — and where the comment warns that nothing will tell you,
because no check flags an orphaned YAML anchor.

So I also corrected that neighbouring comment's count from 3x to 2x, and recorded
why the anchor survives this flip. That count is the only signal telling the next
person whether their flip orphans the anchor or not, and it is unchecked — a stale
count there is how someone eventually deletes a live anchor, or keeps a dead one.

Sequencing

Per this file's own note — "Adding a caller and flipping its entry to required in
the same PR therefore fails, because the caller is not on develop yet. Land the caller
first, flip the entry after." — the caller is already on release-train's develop,
so the flip is safe now.

Verification

repo-inventory.yml parses (yaml.safe_load). The audit itself needs org-wide API
reads, so the real proof is this PR's own caller-drift run coming back clean — that
is the same check that is currently red on #318.

Note this does not unblock .github#318 in the current prod hop. This lands on
develop and needs a staging hop before it reaches a prod payload. #318 stays
refused until then, which is correct.

---

Note

Low Risk
Contract inventory and comment-only change; no runtime, auth, or workflow logic is modified.

Overview
Aligns repo-inventory.yml with the caller that backend#2396 already wired in release-train. customer-priority-bump.yml is now required there instead of exempt, which clears the stale-exemption drift that was failing the org conformance audit.

The shared customer_priority_bump_caller_missing anchor is left in place. A neighbouring bookkeeping comment is updated from 3x to 2x remaining citations so a later flip does not treat the still-used reason as dead prose.

^{Reviewed by Cursor Bugbot for commit c3884bd. Bugbot is set up for automated code reviews on this repo. Configure here.}