chore(ci): retire the public PII gate caller (backend#1409)

[LukasWodka]

Retires this repo's public-PII-gate caller. Lukas's decision, 2026-08-06: remove the gate for now rather than leave it in place undeployed.

Why

PII_DENYLIST has never existed as an org secret, so the gate correctly failed closed on every PR — "an inactive guard must be visible as red, not invisible as green", per its own header. Applied to a secret that was never provisioned, that produced a permanent red across all 7 public repos that blocked nothing: 24 open PRs carried it, and the org — me included — had learned to filter it out. A check that is red on every PR is not fail-closed; it is off with extra steps, and it would have been indistinguishable from noise the day it went red for a real reason.

What lapses, stated plainly

The gate grepped PR title + body + every commit message against a private list of customer/partner names, on public repos only. It never read code, diffs or filenames, and detected no PII patterns — secrets in code remain gitleaks' job. So what lapses is the mechanical backstop for CLAUDE.md's "internal work and customer mentions never go in a public repo". That rule still stands; it is now enforced by review alone.

Reversible

The reusable workflow and its selftest stay in tracebloc/.github, dormant with no callers. Restoring is three steps: set the org secret, restore this file, flip the inventory entry back to required. Checklist and the denylist-content caveat are on backend#1409.

Not required on any branch, so this removes no merge gate. Parent backend#1405.

---

Note

Low Risk
CI-only deletion of a workflow that was not usefully enforcing policy; no application or runtime code changes.

Overview
Removes the .github/workflows/public-pii-gate-caller.yml workflow so this repo no longer runs the reusable tracebloc/.github public PII gate on PR events (opened, edited, reopened, synchronize, labeled, unlabeled).

That caller only delegated to the shared workflow with secrets: inherit; the gate itself (denylist on PR title, body, and commit messages) remains in tracebloc/.github but has no callers here after this change. Per the PR rationale, the check was effectively always failing without PII_DENYLIST, so dropping the caller removes persistent red noise rather than weakening an active merge gate.

^{Reviewed by Cursor Bugbot for commit a7abe67. Bugbot is set up for automated code reviews on this repo. Configure here.}