test: a2a/pii_pipeline.py has no dedicated unit tests #16548

Problem

autobot-backend/a2a/pii_pipeline.py — the repo's only PII/secret detector
bank (14 types: SSN, credit card, API key, JWT, AWS key, bearer token,
email, phone, IP, MAC, internal hostname, customer ID, high-entropy string)
and its BLOCK/REDACT/HASH policy table — has zero dedicated test coverage
anywhere in the repo.

Evidence

$ grep -rl "pii_pipeline\|scrub_outbound\|PIIPipeline" autobot-backend/tests --include="*.py"
(only the new tests/api/test_chat_message_safety.py, added in #16529/#16530,
which exercises it indirectly through the chat-wiring call site)

No tests/a2a/ or tests/test_pii_pipeline.py file exists. The module
backs a production security control (#7355, A2A outbound scrubbing; now also
the main chat path per #16529) with no direct regression coverage of its own
— the 14 detector regexes, the Luhn/entropy validators, the per-type policy
table, or PIIBlocked.

Location

• autobot-backend/a2a/pii_pipeline.py

Discovered via

Found while implementing #16529/#16530 (PR #16545) — checked for existing
PII-pipeline tests to reuse/extend before adding new ones and found none.

Acceptance Criteria

• A dedicated test file covers each of the 14 detector types (true
  positive + a near-miss that should NOT match)
• BLOCK, REDACT, and HASH policy branches are each covered, including
  PIIBlocked's blocked_types
• The Luhn validator (credit card) and Shannon-entropy validator
  (high-entropy string) are covered directly, not only through the
  detector bank
• Policy override loading from ssot_config.a2a_pii_policy is covered