chore(inventory): retire public-pii-gate from the contract (backend#1409)

[LukasWodka]

Completes the retirement Lukas decided today. The 7 callers went first — cli#466, client#638, docs#96, data-ingestors#462, model-zoo#130, start-training#44, .github#182, all merged — and this drops the reusable from the inventory so the contract matches reality.

The ordering was not incidental

The audit reads the inventory from the checkout but every repo's state over the API, so callers and inventory cannot change in one commit. caller-drift.py's docstring documents that hazard for the add direction; the remove direction has it inverted. Callers first, then this. In between, the audit would have reported MISSING required caller for 7 repos — that window is now closed.

Verified before pushing, by running the audit locally against the live fleet:

Inventory: 20 repos x 8 reusables + 2 copies. Audited 20 of 20 on the develop-first branch.
No drift. Every repo read, every entry matched.
exit 0

That matters here more than usual: gate is now a required check on this branch and it keys on exactly these files, so an inventory that disagreed with reality would have blocked this PR — correctly.

Removed

• public-pii-gate.yml from the reusables list
• all 20 per-repo callers entries for it (7 required, 13 exempt)
• the private_repo_no_public_exposure shared reason, now referenced by nothing
• the stale claim in the MATCHING header that public-pii-gate uses the -caller.yml convention — it no longer has callers to have a convention

Kept deliberately

The .github entry's long red-inert explanation is replaced by a short retirement note rather than deleted. Why a guard was withdrawn is the part a future reader needs, and that comment is the only place recording that the denylist never existed at all.

The reusable workflow and its selftest stay in this repo, dormant with no callers, so restoring is three steps — set the org secret, restore the 7 callers, re-add the reusable here — rather than a rebuild.

Parent backend#1405.

---

Note

Low Risk
Inventory-only documentation of an already-merged fleet change; no runtime workflow or guard logic changes in this diff.

Overview
Retires public-pii-gate from repo-inventory.yml so the caller-drift contract matches the fleet after the seven caller workflows were already removed in other repos.

The reusable is dropped from the global reusables list, and every per-repo public-pii-gate.yml caller entry is removed (formerly seven required on public repos and thirteen exempt on private repos). The unused private_repo_no_public_exposure shared exemption anchor goes away with it.

Docs in the inventory are updated: the MATCHING header no longer names public-pii-gate, and the .github entry replaces the long “required / red-inert” note with a short retirement comment (why it was withdrawn and how to restore it). The workflow files themselves are untouched in this PR.

^{Reviewed by Cursor Bugbot for commit 4dcfbce. Bugbot is set up for automated code reviews on this repo. Configure here.}