rill-ci-guards: add GitHub Actions CI guards + local PII pre-push hook

[tarr1124]

Summary

Closes the two guard gaps behind the 2026-07-06 PII incident: no CI, and push-time scans that only saw diff content.

• .github/workflows/ci.yml — 3 jobs on every PR to main:
  • lint: bash -n over all bin/ / plugins/ / test/ shell files (gap-free git ls-files enumeration, verified against the tree) + shellcheck pinned to v0.11.0 (sha256-verified download) at --severity=warning
  • test: every pure-shell test/cli/ suite (10 today, enumerated via glob so future suites are picked up automatically) on ubuntu + macos; no claude CLI anywhere
  • guard: CJK allowlist scan + email/phone/secrets regex scan, each run over the full tree and over the PR's commit messages
• test/cli/cjk-guard.py (stdlib-only): tree mode filtered by test/cjk-allowlist.txt; --raw parity mode (hit-set verified identical to rg's \p{Hiragana}\p{Katakana}\p{Han} scan); --stdin for commit messages (no allowlist)
• test/cli/pii-regex-guard.sh: generic email/phone/secret patterns only (no private vocabulary); per-value allowlisting — allowlisted matches are stripped and the remainder re-scanned, so a real secret sharing a line with a placeholder still fails
• bin/hooks/pre-push-pii-mapping-check.sh: local-only contributor hook; reads private terms from an out-of-repo file ($RILL_DEV_PII_TERMS_FILE or ~/.config/rill-dev/pii-terms.txt), no-ops when absent, blocks on term hits in pushed diffs or commit messages (zero-SHA new-branch case via merge-base). Ships mechanism only.
• shellcheck warning tier now clean (SC2034/SC2155 fixed in bin/rill, SC2088 disabled with reason at 2 call sites, source= directives added); .shellcheckrc documents the policy (rc-file severity is not honored by shellcheck v0.11.0 — verified — so the threshold lives on the command line)

Verification

• bash -n: 46 files, 0 failures; shellcheck v0.11.0 --severity=warning: exit 0 over the 16-file inventory
• CJK guard parity: --raw hit-set diff vs rg reference scan = identical (20 hits, all allowlisted)
• PII guard: 0 unallowlisted tree hits; negative tests confirmed a same-line real address next to an allowlisted placeholder is flagged, and a rogue value inside the allowlist file itself is flagged
• Pre-push hook dry-run in a scratch repo: no-terms-file no-op / commit-message block / new-branch (zero-SHA) content block / clean pass — 4/4
• All 10 test/cli/ suites pass locally on macOS after the bin/rill edits (pipefail static audit included)
• Codex review: 2 rounds of findings (phone/secret pattern coverage, allowlist self-reference loophole, per-value allowlisting) all addressed; final round: 0 findings
• The pull_request-triggered workflow running on this PR is itself part of the verification — the ubuntu leg cannot be exercised locally

Deviations from the task Plan

• Commit-message scans use git log base..head after a fetch-depth: 0 checkout instead of gh api (offline, no extra token scope)
• .shellcheckrc carries policy documentation only; severity=warning moved to the CI command line (rc-file support verified absent in v0.11.0)
• test/cjk-allowlist.txt header updated (2 lines) to declare Python-re syntax, matching the implementation

Merge is intentionally left to the repo owner (task ships up to PR creation only).

🤖 Generated with Claude Code

[tarr1124]

Two follow-up commits after the PR's own first CI run (which was itself part of the verification):

• f3cd9c5 — the ubuntu leg failed 4 suites on the first run. Root cause (reproduced in an ubuntu:24.04 container): 39 standalone ((var++)) sites; when the counter is 0 the arithmetic command returns status 1, and bash >= 4.1 honors set -e there while macOS bash 3.2 does not — so every first increment was a latent Linux crash (this is what killed rill update on ubuntu). Mechanical fix to the assignment form var=$((var + 1)) already documented in test/run-all.sh. All 10 suites + both guards verified green in the container as a non-root user, and the macOS battery stays green.
• 1668400 — codex-review hardening: dash-prefixed tracked filenames could be parsed as grep options (with the error previously swallowed by 2>/dev/null); now passed after -e/--, with grep errors visible on stderr.

Final state: CI green on all 4 checks (lint / test ubuntu / test macos / guard), codex review clean (0 findings).