Add a first-class PII/PHI detector to the redaction gate #108

Problem

Humanish's public-safety story advertises blocking PII/PHI/patient data (humanish/policies/redaction.yaml deny list; docs/contracts/policy.md "required redaction gates"). But the enforced automated gate is a secret/key/token + known-local-path regex denylist. It has no detector for free-form PII/PHI (names, emails, phone numbers, SSNs, DOBs, MRNs, medical detail). A real PHI string would pass redaction: passed and could flow into a public issue draft.

This is the project's central trust claim, and the author works in a healthcare (PHI) context, so the gap is high-consequence.

A companion docs-honesty PR is narrowing the claim now (enforced vs. author-responsibility). This issue tracks closing the gap for real.

Proposed: a first-class PII/PHI detector lane

• A pii-phi detector applied to every public-bound artifact (run bundle text, Observer projection, feedback draft) as part of the redaction gate, failing closed on match.
• Detection tiers:
  • Deterministic high-precision: emails, phone numbers, SSN, credit-card (Luhn), IBAN, IP, dates-of-birth, common MRN/insurance-id shapes.
  • Optional model-assisted NER for names/addresses/medical terms, behind a flag, local-model-friendly (no provider spend by default), with the deterministic tier always on.
• Make it the shared redaction module's responsibility (see Redact absolute workspace path in blocked-TUI bundle + close verify scanner /tmp blind spot #107), so all three current redaction call sites use one detector.
• redaction: passed should then mean "secret/path scan AND PII/PHI scan found no matches," with the verify check naming which tier ran.

Why this is also a differentiator

Public-safe-by-construction is the wedge. A credible, local-first PII/PHI gate that most synthetic-user/agent-eval tools lack turns the biggest current weakness into a defensible feature, and is directly on-brand for a maintainer-facing, public-repo-safe harness.

Acceptance

• Deterministic PII detector with a tested corpus (true positives + non-flagging of synthetic fixtures).
• Wired into the verify gate; planted PII fails closed.
• Docs/policy updated from "author responsibility" to "enforced" for the covered classes.

Related: #107 (shared redaction module)