test: public PII gate smoke check (tracebloc/.github#62)

[saadqbal]

Smoke test: confirms the public-pii-gate.yml@main reusable workflow now resolves after publishing to tracebloc/.github@main (was failing 0s with no jobs). No-op doc file; will be closed once the Public PII gate check goes green. Tracking: tracebloc/.github#62

---

Note

Low Risk
CI-only wiring and a disposable doc file; the workflow ref change is intentional and temporary for validation, with no application or data-path impact.

Overview
Temporary smoke test for the Public PII gate CI check after publishing fixes in tracebloc/.github.

The caller workflow public-pii-gate-caller.yml now pins the reusable workflow to @fix/pii-gate-token-perms instead of @main, so this PR can confirm the gate actually runs (previously it failed in ~0s with no jobs). A throwaway PII_GATE_SMOKE.md was added to document the check and force a fresh synchronize run; both are meant to be reverted or closed once the gate is green on @main (tracebloc/.github#62).

^{Reviewed by Cursor Bugbot for commit b27747b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 31 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• .github#57 — fix(fr-gate): pass items at or beyond the required stage · author: @aptracebloc · no reviewer assigned
• .github#61 — fix(wip-limit): avoid sort|head SIGPIPE failing the WIP check when queue >10 · author: @shujaatTracebloc · reviewer: @saadqbal
• averaging-service#119 — fix(averaging): exact federated GaussianNB merge — usable + correct (WS-B B2, cli: logout must call POST /auth/revoke to revoke the token server-side (RFC-0001 R2 / §7.5) #112) · author: @divyasinghds · no reviewer assigned
• backend#815 — chore(deps): bump cryptography from 47.0.0 to 48.0.1 · author: @dependabot · no reviewer assigned
• backend#833 — fix(deploy): graceful shutdown + Dockerfile hygiene; drop dead EC2 script · author: @LukasWodka · no reviewer assigned
• backend#840 — feat(rfc-0001): namespace-slug rule + validation command (#837) · author: @LukasWodka · no reviewer assigned
• backend#843 — fix(test): connect local MySQL test DB over TCP + document mac test-tier setup · author: @LukasWodka · reviewer: @saadqbal
• backend#844 — fix(test): activate ServiceBusMock under pytest so experiment-utils tests don't hang · author: @LukasWodka · reviewer: @saadqbal
• backend#845 — feat(auth): add ClientAccessToken — bounded, revocable bearer token for the CLI (#835) · author: @LukasWodka · reviewer: @saadqbal
• backend#846 — feat(auth): device-authorization endpoints (RFC 8628) for CLI sign-in (#835) · author: @LukasWodka · reviewer: @saadqbal

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b27747b. Configure here.}

[cursor]

Caller pins unstable workflow ref

High Severity

The reusable workflow uses ref was changed from @main to @fix/pii-gate-token-perms, while the new smoke doc and PR goal say the check validates resolution from @main. Every other caller workflow in this repo pins @main. Merging this leaves the Public PII gate on a short-lived branch ref that can break all PR checks when that branch is removed.

Additional Locations (1)

• PII_GATE_SMOKE.md#L2-L3

^{Reviewed by Cursor Bugbot for commit b27747b. Configure here.}

[saadqbal]

Test PR for tracebloc/.github#62 — confirmed the Public PII gate resolves and runs green once the reusable workflow's token-perms are fixed (run 27748465192, minimal caller). Closing; fix tracked in tracebloc/.github#63.