fix(config): remove three inert project-root placeholders and one orphaned copy (#15044)

[mrveiss]

Thinking Path

Three configs carried ${AUTOBOT_PROJECT_ROOT} placeholders that nothing ever
expands, so each shipped a literal dollar-brace string where a path was meant.
The failure is silent — a config value that is a placeholder rather than a path
does not raise; it produces a file in a nonsense location or an empty result.

docs/audit/project_root_yaml_json_audit.md (#15040) recorded two of these as
"no fix needed". That verdict is what #15044 exists to correct, and the audit doc
is updated with it.

This PR covers #15044 only. It was dispatched as a three-issue batch with
#14892 and #15193; both turned out to be already fixed and needed no code.
They are verified and closed separately rather than folded in here, because a PR
that closes an issue it did not change is a closure with no diff behind it.

What Changed

File	Change	Why
logging.yml	filename → repo-relative; header added	Not dead. log_aggregator.py --setup regenerates it, and repo_tests/logging_formatter_path_test.py asserts it exists and reads formatters.json.class from it. Deleting it breaks a passing guard
threat_detection.yaml	three ml_models keys removed	ThreatDetectionEngine._get_default_config() reads only model_retrain_hours and min_training_samples; profile persistence uses an unrelated path helper. No consumer of the three exists
logging/promtail/promtail-config.yml	deleted	see below
hardcoded_values_baseline.txt	1 stranded entry pruned	removal-only, 1380 → 1379 keys

The deletion, and why it is not removing unfinished work

This repo's rule is that debris is unfinished work to be wired in, and deletion
is correct only once nothing depends on it. So the promtail copy gets four
independent lines of evidence rather than one:

1. the deployed unit's ExecStart loads {{ promtail_config_dir }}/config.yml —
   a different filename in a different directory (/etc/autobot/promtail)
2. that file is rendered fresh from templates/promtail-config.yml.j2, whose
   content differs materially from the checked-in copy — different job names, no
   __HOST__ templating, no placeholder at all
3. there is no -config.expand-env=true anywhere, so the placeholder would
   remain a literal string even if something did load this file
4. git grep for the path across all tracked files, excluding the audit doc and
   the pruned baseline, returns zero hits

I verified 1 and 4 myself rather than accepting them. This is not a feature
half-built; it is a file no code path can reach.

Verification

$ python3 -m pytest repo_tests/no_inert_config_placeholder_15044_test.py \
    repo_tests/logging_formatter_path_test.py -q
12 passed, 1 skipped in 0.21s

$ bash pipeline-scripts/detect-hardcoded-values.sh --report
Status: pass | New violations: 0

$ python3 scripts/check_python_file_size.py --audit-ceilings
5044 files scanned, 499 grandfathered, all live and at size.

Mutations, each red then green on restore:

Mutation	Failure
logging.yml filename back to the placeholder	test_filename_is_not_an_unexpanded_placeholder
promtail-config.yml recreated	test_the_orphaned_promtail_copy_stays_removed
model_storage_path reinserted	test_none_of_the_dead_keys_are_present

The one skip is pythonjsonlogger absent from this venv; the durable half of
that guard still ran.

Not verified

The full repo_tests/ suite did not complete — it was killed after ~10
minutes. The runs above are narrow, covering the touched files and the
pre-existing guard this change could plausibly break. CI is the check that
matters here and it has not been avoided; it simply has not run yet at the time
of writing.

Model Used

Claude Opus 5

Closes #15044

Refs #14892, #15193 — this branch is named for #14892 because it was dispatched
as a three-issue batch. It does not close that issue, and says so
deliberately: #14892 and #15193 were both already fixed by prior work
(5633e418c / PR #15175), verified against merged base this session, and closed
separately on that evidence rather than on this diff. A PR that ticked them here
would be claiming a closure with no change behind it.

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No new hardcoded values of either class — ssot and other both block.

Known backlog in pipeline-scripts/hardcoded_values_baseline.txt is suppressed and tracked in #14371.