fix(pii-gate): run under restrictive default token perms (contents-scoped Compare API)

[saadqbal]

Problem

After publishing `public-pii-gate.yml` to main (#60), the Public PII gate still failed at startup with 0 jobs on every PR in adopting repos (cli, data-ingestors).

Root cause: the reusable workflow declared `permissions: { contents: read, pull-requests: read }`, but those repos' default workflow token permission is "read" (grants `contents`/`packages` read; `pull-requests: none`). A minimal caller (`uses:` + `secrets: inherit`, no `permissions:` block) therefore cannot grant `pull-requests`, so the called workflow's request exceeds the caller's ceiling → startup failure, no jobs.

Fix

Make the reusable workflow self-sufficient under the restrictive default so callers stay trivial (no per-repo `permissions:` block, no recurring footgun):

• Read commit messages via the Compare API (`repos/{repo}/compare/{base}...{head}`), which is contents-scoped, instead of `gh pr view --json commits` (pull-requests-scoped).
• Request only `permissions: contents: read` (least privilege).

Title/body/labels already come from the event payload (no API). Full scan coverage (title + body + commit messages) is preserved.

Verification

On a test PR in tracebloc/cli with an unmodified minimal caller pointed at this branch, the gate ran green (jobs executed, no startup failure) — run 27748465192. Before the fix, identical minimal callers @main produced 0-job startup failures.

Tracking: #62

---

Note

Low Risk
CI-only permission and API change for PR text scanning; same haystack sources with a documented 250-commit Compare API cap.

Overview
Fixes reusable Public PII gate workflows that failed at startup with 0 jobs when called from repos whose default GITHUB_TOKEN only grants contents: read (no pull-requests).

The workflow now requests permissions: contents: read only (drops pull-requests: read) and loads commit messages via the Compare API (repos/.../compare/{base}...{head}) using PR_BASE_SHA / PR_HEAD_SHA from the event, instead of gh pr view --json commits. PR title, body, and labels still come from the payload; scan coverage is unchanged.

Header comments document why pull-requests must not be requested and the 250-commit Compare API limit.

^{Reviewed by Cursor Bugbot for commit 5fad0d9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 32 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• .github#57 — fix(fr-gate): pass items at or beyond the required stage · author: @aptracebloc · no reviewer assigned
• .github#61 — fix(wip-limit): avoid sort|head SIGPIPE failing the WIP check when queue >10 · author: @shujaatTracebloc · reviewer: @saadqbal
• averaging-service#121 — fix(averaging): fail loud for un-mergeable sklearn estimators (WS-B B2 W2, promote: cross-repo change guidance (develop -> main) #112) · author: @divyasinghds · no reviewer assigned
• backend#815 — chore(deps): bump cryptography from 47.0.0 to 48.0.1 · author: @dependabot · no reviewer assigned
• backend#833 — fix(deploy): graceful shutdown + Dockerfile hygiene; drop dead EC2 script · author: @LukasWodka · no reviewer assigned
• backend#840 — feat(rfc-0001): namespace-slug rule + validation command (#837) · author: @LukasWodka · no reviewer assigned
• backend#843 — fix(test): connect local MySQL test DB over TCP + document mac test-tier setup · author: @LukasWodka · reviewer: @saadqbal
• backend#844 — fix(test): activate ServiceBusMock under pytest so experiment-utils tests don't hang · author: @LukasWodka · reviewer: @saadqbal
• backend#845 — feat(auth): add ClientAccessToken — bounded, revocable bearer token for the CLI (#835) · author: @LukasWodka · reviewer: @saadqbal
• backend#846 — feat(auth): device-authorization endpoints (RFC 8628) for CLI sign-in (#835) · author: @LukasWodka · reviewer: @saadqbal

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[saadqbal]

Verified green on a test PR in tracebloc/cli with an unmodified minimal caller (run 27748465192) — jobs run, no startup failure; before the fix the same minimal caller @main gave 0-job startup failures. Needs one approving review from a non-author (org ruleset on main blocks self-approval, admin-merge, and direct push). Once approved I'll squash-merge and re-verify on main. Tracking #62.